[infra-lead-agent] fix(ci): make go vet hard-failing in weekly-platform-go (#567/#612 followup)

#612 added weekly-platform-go.yml with `go vet ./... || true`, which makes the
step pass even when there's a vet error — defeating the workflow's stated
purpose (#567: surface latent vet errors on main; the motivating case was a
`go vet` error in org_external.go that sat undetected for weeks). With `|| true`
the only signal is log output on an unattended scheduled run, which nobody reads.

This removes the `|| true` from the `go vet` step so vet errors fail the step →
fail the job → show red on the weekly commit (which, per Gitea quirk #10 — job-
level continue-on-error is ignored — they will; that red IS the intended signal).
golangci-lint keeps its `|| true` guard (lint is noisier; golangci-lint may not
be pre-installed on every runner image) — commented inline.

Workflow-only change → §SOP-13 §3 carve-out (tier:low). Author = infra-lead;
merger must be a non-author non-reviewer engineer with the 4-field §3 audit
comment posted first. Not urgent — the weekly cron runs Mondays.

.gitea/workflows/weekly-platform-go.yml

@@ -53,9 +53,20 @@ jobs:
       - name: Build
         run: go build ./cmd/server
 
+      # `go vet` is NOT `|| true`-guarded: surfacing latent vet errors on main is
+      # the whole point of this workflow (issue #567 — the motivating case was a
+      # `go vet` error in org_external.go that sat undetected on main for weeks).
+      # A vet error here fails the step → fails the job → shows red on the weekly
+      # commit. Per Gitea quirk #10 (job-level continue-on-error is ignored), that
+      # red surfaces on main — which is the intended signal, not a regression.
       - name: go vet
-        run: go vet ./... || true
+        run: go vet ./...
 
+      # golangci-lint stays `|| true`-guarded: lint is noisier (more false-
+      # positives than vet) and golangci-lint may not be pre-installed on every
+      # runner image — a `|| true` here keeps a missing-binary or lint-noise case
+      # from masking the vet/test signal above. Tighten to match ci.yml's lint
+      # gate if/when ci.yml's lint step becomes hard-failing.
       - name: golangci-lint
         run: golangci-lint run --timeout 3m ./... || true