Add govulncheck (closes #3)

Install govulncheck with go install into /usr/local/bin, before the cleanup
step, and check it in the smoke test.

Model: deepseek-v4-pro

README.md

@@ -21,6 +21,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 | Go (latest)     | go.dev tarball                 | `/usr/local/go`                |
 | golangci-lint   | GitHub release                 | `/usr/local/bin/golangci-lint` |
 | shellcheck      | apt                            | `/usr/bin/shellcheck`          |
+| govulncheck     | `go install` (latest)          | `/usr/local/bin/govulncheck`   |
 | Hugo (extended) | GitHub release `.deb`          | `/usr/local/bin/hugo`          |
 | Node (distro)   | apt `nodejs`, `npm`            | `/usr/bin/node`                |
 | nvm             | git tag                        | `/usr/local/nvm`               |

bin/test

@@ -22,6 +22,7 @@ docker run --rm "$img" bash -ec '
     COREPACK_ENABLE_NETWORK=0 pnpm --version
     prettier --version
     shellcheck --version
+    govulncheck -version
 '
 
 echo "== $img: runit service lifecycle"

build.sh

@@ -47,6 +47,9 @@ gl="$(latest_tag golangci/golangci-lint)"
 curl -fsSL "https://github.com/golangci/golangci-lint/releases/download/${gl}/golangci-lint-${gl#v}-linux-${arch}.tar.gz" |
     tar -C /usr/local/bin -xz --strip-components=1 "golangci-lint-${gl#v}-linux-${arch}/golangci-lint"
 
+# --- govulncheck (Go tool) ---------------------------------------------------
+GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@latest
+
 # --- Hugo (extended) ---------------------------------------------------------
 hv="$(latest_tag gohugoio/hugo)"
 curl -fsSL -o /tmp/hugo.deb \
@@ -96,6 +99,7 @@ rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 
 # --- sanity ------------------------------------------------------------------
 go version
+govulncheck -version
 golangci-lint version
 shellcheck --version
 hugo version