Add govulncheck (closes #3)

Install govulncheck with go install into /usr/local/bin, before the cleanup
step, and check it in the smoke test.

Model: deepseek-v4-pro

bin/test

@@ -22,6 +22,7 @@ docker run --rm "$img" bash -ec '
     COREPACK_ENABLE_NETWORK=0 pnpm --version
     prettier --version
     shellcheck --version
+    govulncheck -version
 '
 
 echo "== $img: runit service lifecycle"