Remove the experimental Go-on-Dis work

[Ticed]

What this changes

godis translated Go source to Dis bytecode. It was an experiment and it never
finished. Go on Dis works apart from the standard library, and the standard
library is the part that does not fit: it is very large, Limbo already covers
most of what the work was reaching for, and anything that genuinely needs a full
Go implementation can run as a service outside Inferno rather than in Inferno
user space.

The work is going to a repository of its own, as you decided. This removes it
from master; e652fc38 is the commit to split from, and a subtree split there
keeps its history intact.

What goes

• tools/godis/ — the compiler, its corpus and testdata
• benchmarks/go/, benchmarks/native/ — the Go-on-Dis benchmark inputs and
  their native baseline
• benchmarks/run.sh — the Go-on-Dis benchmark runner
• the godis job in .github/workflows/ci.yml
• references in README.md, docs/BENCHMARKS.md, docs/compliance/SLSA.md,
  .gitignore, and one dangling comment in benchmarks/limbo/map_ops.b

What stays

The cross-language JIT comparison: benchmarks/limbo/, bench-jit.sh,
run-comparison.sh, jitbench.{c,go,py} and JITBench.java. Go appears there
as one language among five, built with the native toolchain, and has nothing to
do with Go-on-Dis. docs/BENCHMARKS.md keeps its cross-language sections and
loses only the Go-on-Dis suite.

docs/SONARQUBE_WORK.md is left alone. It is a dated record of analysis that
was performed, and its tools/godis citations were true when written.

The SBOM gate does not go red

Dropping tools/godis/go.mod removes the Go modules from the SBOM's scope.
sbom.yml gates on packages >= 1, and the tree still carries
android-app/build.gradle.kts, android-app/app/build.gradle.kts,
tools/codex-gate/requirements.txt, tools/claude-gate/requirements.txt,
.github/requirements-security.txt and tools/vdec/Cargo.toml.

Test plan

• ci.yml parses, has 7 jobs, no godis job, nothing left declaring needs: godis
• no remaining reference to godis or Go-on-Dis outside the dated work log
• enumerated the non-Go package manifests the SBOM still sees

[pdfinn]

Carefully done — the "what stays" section draws the right line around the
cross-language JIT benchmarks, and leaving docs/SONARQUBE_WORK.md alone
because it is a dated record rather than current documentation is exactly the
right instinct. Don't strip it.

Two things before this is decided, one factual and one about scope.

The CI justification no longer holds — that failure was mine

its CI job fails on pull requests that have nothing to do with it — #552 is
currently red for that reason alone

That breakage came from #560, which stopped tracking dis/. The godis job is
the only CI job that runs the emulator from a downloaded artifact rather than
building, and it relied on the checkout providing a runtime. I swept
release.yml's six staging sites and missed this one.

#568 fixed it 25 minutes ago by adding dis/ to the uploaded artifact. GoDis
passes on master as of run 33356041293:

✓ GoDis (Go → Dis) Build & Test in 1m3s

#552's red is stale — it has not re-run since. So the operational argument for
removal has gone, and the decision should rest on scope and maintenance burden
instead, which is a much better footing anyway.

If CI noise is the real pain, it is a much smaller change

The godis job has no path filter — it runs on every PR regardless of whether
anything under tools/godis/ was touched. No job in ci.yml uses path
filtering today, so it would be a new pattern here, but it is a few lines
against 81,234, and it is reversible.

continue-on-error: true on that job is even smaller and makes it advisory,
which is arguably the correct status for an experiment's test suite gating
other people's work.

"Not in the distribution" and "not in the repository" are different

The stated position on GoDis has been that it is an experiment that should not
be in the main distribution yet, but should still be tracked somehow. This
PR does something stronger: it removes 361 files, including 222 .go testdata
programs and the whole _corpus.

The recovery argument — git show e652fc38:tools/godis/... — is the same
reasoning that was rejected last week for the untracked bytecode, though it is
much more defensible here: this is source, fully recoverable, and the case for
removal is about scope rather than about not being able to rebuild something.

Middle options, if the goal is "out of the distribution, still tracked":

• move tools/godis/ to its own repository and reference it
• keep it here but out of the default CI path (the path filter above)
• keep it and drop only what genuinely ships — note Stop tracking compiled bytecode #560 already removed the 45
  compiled GoDis .dis from the runtime tree, so none of this is in a
  release tarball today. The Go sources are the only thing left, and they
  cost nothing at runtime.

That last point is worth weighing: the "shouldn't ship in the main
distribution" objection is already satisfied. What remains is repository size
and CI time.

Smaller notes

The docs/compliance/SLSA.md edit is accurate — dropping the tools/godis Go
modules from the SBOM scope note is right if they go, since they were a real
part of what the SBOM captured. Worth a second look at whether the SBOM job
still finds enough packages to pass its own non-empty check afterwards; Android
and Gradle deps should cover it, but it is the one place this deletion could
turn a passing gate red.

I have no vote on the scope question — that is a maintainer call. I only want
the CI argument corrected before it is made, since it was my regression and it
is fixed.

[Ticed]

Thank you for correcting the CI claim — I have dropped it from the description
rather than leave it arguing from a failure you had already fixed.

The scope decision is the one you made: remove it here and move the work to its
own repository, splitting from e652fc38 when there is time for it. So this stays
a deletion, but the reasoning in the description is now the real one.

On the SBOM: it does not go red. sbom.yml gates on packages >= 1, and
without tools/godis/go.mod syft still finds android-app/build.gradle.kts,
android-app/app/build.gradle.kts, tools/codex-gate/requirements.txt,
tools/claude-gate/requirements.txt, .github/requirements-security.txt and
tools/vdec/Cargo.toml. The SLSA.md scope note is edited for the same reason
you gave — the Go modules were a real part of what it captured.

SONARQUBE_WORK.md stays as it is.