ci-pipeline-cleanup Phase 4: gofmt parity + go mod tidy drift

Bundle: ci-pipeline-cleanup, Phase 4 / frozen decision 0.13.

Two new steps in go-build-and-test:

1. gofmt drift (Makefile::verify parity)
   Makefile::verify runs gofmt + vet + golangci-lint + go test.
   CI was running 3 of those 4 (vet, lint, test) but NOT gofmt.
   This step closes the parity gap with the smallest possible diff —
   one gofmt -l invocation that fails on any unformatted source.
   (Alternative considered: invoke 'make verify' as a single step.
   Rejected because vet/lint/test would run twice — once via 'make verify'
   and once via the existing per-step CI invocations. Adds ~5-7 min
   wall-clock for no behavior gain.)

2. go mod tidy drift
   Catches PRs that import a package without committing the go.mod /
   go.sum update. Standard Go-CI gate; absent before this bundle.
   Runs 'go mod tidy && git diff --exit-code go.mod go.sum'.

ci.yml gains ~16 lines net for these two checks.

.github/workflows/ci.yml

@@ -28,6 +28,28 @@ jobs:
           go build ./cmd/mcp-server/...
           go build ./cmd/cli/...
 
+      - name: gofmt drift (Makefile::verify parity)
+        # ci-pipeline-cleanup Phase 4 / frozen decision 0.13: Makefile::verify
+        # checks gofmt + vet + golangci-lint + go test. CI runs vet, lint, test
+        # already — but NOT gofmt. This step closes the parity gap.
+        # Mirrors the Makefile::verify shape: any gofmt output means the
+        # source needs reformatting.
+        run: |
+          out=$(gofmt -l .)
+          if [ -n "$out" ]; then
+            echo "::error::gofmt would reformat these files (run 'gofmt -w' locally):"
+            echo "$out"
+            exit 1
+          fi
+
+      - name: go mod tidy drift
+        # ci-pipeline-cleanup Phase 4: catches PRs that import a package
+        # without committing the go.mod / go.sum update. Standard Go-CI
+        # gate; absent before this bundle.
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
       - name: Go Vet
         run: go vet ./...