chore: align CI, release, and tooling to axonops/mask pattern

[millerjp]

Summary

Re-platforms syncmap's CI/release/tooling to mirror github.com/axonops/mask exactly. The earlier infrastructure PRs (#2, #4, #6) landed a bespoke approach; the mask pattern is the canonical AxonOps Go-library template and must be the source of truth. Replaces all infrastructure files, adds Apache 2.0 headers so the apache-header-guard job passes, and lays the groundwork for release automation plus Dependabot. Supersedes the closed #7.

Requirements

1. Replace (files currently on main, already merged in chore: add .gitignore, Makefile, and .golangci.yml (#3) #4/ci: add GitHub Actions CI workflow (#5) #6 — will be overwritten):

   • Makefile — adopt mask's target set, SHELL := bash with -eu -o pipefail, make check includes coverage, add bench-regression, llms-full, llms-full-check, clean.
   • .golangci.yml — adopt mask's v2 config exactly: default: none, explicit enables (errcheck, govet, ineffassign, staticcheck, unused, misspell, gocyclo, gocritic, revive, unconvert, unparam, bodyclose, goconst, prealloc, nolintlint, copyloopvar). UK misspell locale. Adjust goimports.local-prefixes to github.com/axonops/syncmap.
   • .gitignore — adopt mask's list verbatim. Keep the CLAUDE.md / .claude/ entries.
   • .github/workflows/ci.yml — adopt mask's job layout and action pins (actions/checkout@v6.0.2, actions/setup-go@v6.4.0, actions/upload-artifact@v7.0.1, golangci/golangci-lint-action@v9.2.0, goreleaser/goreleaser-action@v7.0.0, DavidAnson/markdownlint-cli2-action@v21.0.0). Go "1.26". Port every guard job that applies (local-paths-guard, apache-header-guard, attribution-guard, makefile-targets-guard, lint, test matrix, build matrix, security, release-check). Adjust coverage threshold to 95% per CLAUDE.md §Testing.

2. Add (new):

   • .github/workflows/release.yml — workflow_dispatch-only release with mask's verify → tag → goreleaser → proxy-warm job sequence. dry_run input. CI-only tag creation via github-actions[bot].
   • .goreleaser.yml — version: 2, builds: [{skip: true}], source archive + sha256 checksums + mask's grouped GitHub changelog + mask's release header/footer templates adapted for syncmap. Archive files: list contains only files that exist at merge time (LICENSE, README.md); Phase 5 expands the list.
   • .github/dependabot.yml — weekly gomod + github-actions updates, mask's schedule and labels.
   • .github/workflows/dependabot-automerge.yml — mask's version verbatim.

3. Add Apache 2.0 headers to the two Go files currently on main so the new apache-header-guard job passes:

   • syncmap.go
   • syncmap_smoke_test.go
     (This is minimal scope creep — without it, the CI fails on the first push. The full godoc rewrite remains with issue ci: add GitHub Actions CI workflow (#5) #6.)

4. Defer to Phase 5:

   • .github/workflows/cla.yml and .github/workflows/contributors.yml — both require CLA.md, CONTRIBUTORS.md, signatures/version1/cla.json, scripts/generate-contributors.sh, and the CLA_ASSISTANT_PAT secret. Land them together when Phase 5 drops CLA content.
   • llms-full-up-to-date guard job — requires scripts/gen-llms-full.sh + llms-full.txt. Re-enable in Phase 5.
   • markdownlint guard job — requires README/CONTRIBUTING/SECURITY content. Re-enable in Phase 5.
   • bdd-strict-mode-guard — requires tests/bdd/ + godog entry file. Re-enable in feat: add Swap and Clear methods #13.
   • benchstat-regression-guard — requires bench.txt baseline + scripts/check-bench-regression.sh. Re-enable in feat!: rename Items to Values #12.

5. Repo-specific adjustments wherever values appear: project_name: syncmap, owner/name: axonops/syncmap, local-prefixes: github.com/axonops/syncmap, proxy URL paths, labels, concurrency groups.

Acceptance Criteria

1. diff <(curl mask/Makefile) Makefile shows only: (a) GORELEASER var — unchanged; (b) dropped targets for scripts syncmap doesn't have yet (llms-full, llms-full-check, bench-regression); (c) adjusted BDD_PKG path if present. No other drift.
2. diff <(curl mask/.golangci.yml) .golangci.yml shows only local-prefixes: github.com/axonops/syncmap and the mask-specific hash.go path exclusion removed.
3. diff <(curl mask/.github/workflows/ci.yml) .github/workflows/ci.yml shows only: removed guard jobs enumerated in Req 4, plus axonops/mask → axonops/syncmap substitutions, plus 90% → 95% coverage threshold.
4. diff <(curl mask/.github/workflows/release.yml) .github/workflows/release.yml shows only axonops/mask → axonops/syncmap substitutions.
5. diff <(curl mask/.goreleaser.yml) .goreleaser.yml shows only project_name, owner/name, header prose, and the archives.files list reduced to files that exist at merge time.
6. diff <(curl mask/.github/dependabot.yml) .github/dependabot.yml — label adjustments only; same schedule and same grouping.
7. diff <(curl mask/.github/workflows/dependabot-automerge.yml) .github/workflows/dependabot-automerge.yml is empty.
8. actionlint .github/workflows/*.yml exits 0.
9. make release-check passes (goreleaser check).
10. goreleaser release --snapshot --clean --skip=publish produces dist/syncmap-*-source.tar.gz and dist/checksums.txt.
11. make check passes (fmt-check + vet + lint + tidy-check + test + test-bdd + coverage + security). Coverage ≥95% on the library.
12. CI on the PR is fully green — every kept guard job and the test/build matrices pass.
13. Every .go file on main after merge carries the Apache 2.0 header. git ls-files '*.go' | xargs grep -L 'Licensed under the Apache License, Version 2.0' returns empty.

Testing Requirements

• actionlint .github/workflows/*.yml locally — document output in PR.
• make check locally — document output in PR.
• make release-check locally — document output in PR.
• goreleaser release --snapshot --clean --skip=publish locally — document dist/ listing in PR.
• CI on the PR branch — every job green, screenshot or link in the PR description.
• Coverage reported at ≥95% (the existing smoke test already hits 36% — this PR does NOT attempt to close the coverage gap; that work belongs to docs: add doc.go and rewrite godoc on every exported symbol #11. If the coverage gate fails at 95%, the gate must be tuned to 90% with a TODO(docs: add doc.go and rewrite godoc on every exported symbol #11) note OR this PR stays blocked until docs: add doc.go and rewrite godoc on every exported symbol #11 lands first).

Documentation Requirements

• None in this PR. Phase 5 issues (feat: add top-level CompareAndSwap and CompareAndDelete functions #14, test: add benchmarks, runnable examples, and bench-regression infrastructure #15) own README/CONTRIBUTING/CLA/CODE_OF_CONDUCT/SECURITY/CHANGELOG/NOTICE/CONTRIBUTORS.

Dependencies

• Closed ci: add GoReleaser config and release workflow with GitHub attestations #7 (previous scope was too narrow).
• Blocked by: none.
• Blocks: chore: add .gitignore, Makefile, and .golangci.yml (#3) #4-ci: add GitHub Actions CI workflow #5 items from the original plan — no longer independent issues since this bundle replaces them.
• Re-enablement of the deferred guards (cla, contributors, llms, markdownlint, bdd-strict, benchstat) is tracked in Phase 4/5 issues.

Labels

• chore
• ci/cd
• P0