chore(go): inject release service dependencies and mirror local validation

.gitea/workflows/prepare-release.yml

@@ -39,8 +39,31 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
+      - name: Validate formatting
+        run: test -z "$(gofmt -l .)"
+
+      - name: Module hygiene
+        run: |
+          set -euo pipefail
+          go mod tidy
+          go mod verify
+
+      - name: Run gosec security analysis
+        uses: securego/gosec@v2
+        with:
+          args: ./...
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-package: ./...
+          cache: true
+          cache-dependency-path: go.sum
+
       - name: Run tests
-        run: go test ./...
+        run: |
+          set -euo pipefail
+          go test ./...
 
       - name: Resolve cache token
         id: cache-token