Add govulncheck (closes #3)

Install govulncheck with go install after the cleanup step, into
/usr/local/bin so it survives the /root/go removal, and check it in the
smoke test.

Model: deepseek-v4-pro

README.md

@@ -21,6 +21,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 | Go (latest)     | go.dev tarball                 | `/usr/local/go`                |
 | golangci-lint   | GitHub release                 | `/usr/local/bin/golangci-lint` |
 | shellcheck      | apt                            | `/usr/bin/shellcheck`          |
+| govulncheck     | `go install` (latest)          | `/usr/local/bin/govulncheck`   |
 | Hugo (extended) | GitHub release `.deb`          | `/usr/local/bin/hugo`          |
 | Node (distro)   | apt `nodejs`, `npm`            | `/usr/bin/node`                |
 | nvm             | git tag                        | `/usr/local/nvm`               |