chore(sdk/go): migrate the Go SDK to ai-openshell/sdk-go #5031

User Story

I maintain the Go SDK and use it from Go controllers against OpenShell gateways. RFC 0019 (#4426) moves the SDKs first, and ai-openshell/sdk-go now exists. I'd like to carry out that move for Go and record the steps so the Python and TypeScript SDKs, packages, and the other repositories can follow the same path.

Problem Statement

The Go SDK still lives in sdk/go and is built, gated, and tagged by core CI. Its bindings are generated straight from proto/, so any core PR that changes a proto has to regenerate Go code. Around 25 open non-SDK PRs touch sdk/go/ for that reason alone. Stable releases also create sdk/go/vX.Y.Z tags, which broke Release Dev version computation until #5018 filtered them out.

Impact / Why This Matters

• Core contributors stop regenerating Go bindings for proto changes.
• SDK maintainers own their CI, reviews, and releases without core review bandwidth, which is the goal of RFC 0019.
• Consumers move to a new module path, github.com/ai-openshell/sdk-go. The old path gets a deprecation notice on pkg.go.dev.

Proposed Design

Freeze and flip, in phases:

1. Prerequisites. Grow the sdk team in ai-openshell/infra and install the org GitHub App on sdk-go. Announce a freeze date and merge the SDK PRs that are ready before it.
2. Import. Extract sdk/go with its history (git filter-repo --subdirectory-filter, with #N rewritten to NVIDIA/OpenShell#N). A second PR switches the module path, pins buf to a core release tag through a git input, and adds standalone CI.
3. Cutover. Port the remaining open SDK PRs with their authors preserved. In core, remove the Go job and go:proto:check from gating.
4. Automation in sdk-go.
   • A scheduled job watches core stable and pre-release tags and opens a bump PR for each one, with the proto diff and E2E results against that release's gateway.
   • A merged stable bump tags the same vX.Y.Z (lockstep with core).
   • A nightly drift check runs against core main.
   • Failing bumps get a label so an agent can pick them up.
5. Retire in core.
   • Tag a final sdk/go/v0.1.N with // Deprecated in go.mod.
   • Remove sdk/go, tasks/go.toml, the CodeQL Go entry, and the Go tag workflow.
   • Update the docs, AGENTS.md, CONTRIBUTING, and skills.
6. Release. Ship the first lockstep release from sdk-go.

Acceptance Criteria

• github.com/ai-openshell/sdk-go builds, tests, and generates bindings without a core checkout.
• Core CI and releases no longer reference sdk/go, and core proto PRs no longer touch Go code.
• pkg.go.dev shows the old module path as deprecated, pointing to the new one.
• A core release produces a bump PR in sdk-go without manual steps, and a merged stable bump produces a matching SDK release.
• A written migration log with lessons learned is available for the next repository move.

Alternatives Considered

• Mirror sdk/go into sdk-go with a publishing bot until CI is proven. This doubles maintenance and the mirror tooling gets thrown away.
• Vendor a copy of the protos in sdk-go, or publish them to the Buf Schema Registry. The pinned buf git input avoids copies and needs no new publishing step in core.
• Keep the SDK in the monorepo and delegate through CODEOWNERS. RFC 0019 already weighs this option.

Agent Investigation

An agent mapped the current coupling (CI jobs, release workflows, CodeQL, docs, open PRs) and the target org's rulesets and Terraform config by reading code and repository settings. Nothing was executed against either repository.

• I've reviewed existing issues and the published docs
• This is a design proposal, not a "please build this" request