chore: pin the linters and run the sidecar spec in ci

[undont]

Summary

• test: go-test runs under -race; the sidecar is a goroutine per request over a shared client and cache
• build: all four linters pinned and fetched into .tools, and ci runs the make targets rather than marketplace actions. luacheck pins its interpreter too: 1.2.0 will not load on lua 5.5
• build: .golangci.yml names the v2 defaults, and stops golangci-lint walking up into a parent's config
• test: lua-test-nvim builds the sidecar, so sidecar_spec runs rather than skipping as it has on every pr since it was written
• test: cover the 60s request timeout, by SIGSTOPping the sidecar and standing in for vim.uv.new_timer
• test: post every graphql document to the live schema. the go tests fake at the RoundTripper boundary, which is how get_pending_review shipped broken in every release
• chore: fail a pr that has not closed off the last release. missed for v0.1.25, v0.1.26 and v0.1.30; v0.1.30 is closed off here
• test: two blob-path call counters were racy, caught by the new -race leg on its first full run
• docs: document what bare :Differ opens, and the merge-tool reroute
• lua-test (v0.12.0) and gql-validate added to main's required checks

Test plan

• make check: unit 370/0, headless-nvim 444/0 with 0 pending, luacheck 0, golangci-lint 0, lua_ls clean, demo-build ok, go ok under -race
• make gql-validate: 21 documents accepted, and it fails on the reinstated get_pending_review bug
• the timeout test fails against the rejection neutered; sidecar_spec fails in 0.003s with no binary
• the changelog check fails on the tree as it stood, and passes on equality and on an empty [Unreleased]
• cold .tools fetch of all four tools, each guard failing on a bad pin
• 30 runs of the blob-cache tests under -race, plus 3 full go test -race ./...
• make vimdoc regenerates doc/differ.txt unchanged