[simonswine]

Summary

• Check Go formatting and go vet; run the full Go suite with the race detector.
• Install pinned frontend dependencies and run unit plus Chromium integration tests.
• Rebuild frontend assets and fail if tracked assets differ or generated files are untracked.
• Pin GitHub Actions to commit SHAs, use read-only permissions, and disable persisted checkout credentials.
• Fix an existing gofmt issue and wait for asynchronous canvas sizing in browser tests.

Validation

• nix run sys#zizmor -- .github/workflows/ci.yml: no findings
• go vet ./...
• go test -race ./... -count=1
• Go formatting check
• pnpm install --frozen-lockfile
• pnpm test: 5 passed
• pnpm test:integration: 3 passed
• Rebuilt assets match committed files
• git diff --check