feat(go-services): tracker-go Phase 0/1 — /live + /trails read parity

Parallel Go reimplementation of the dereth-tracker read side, deployed
loopback-only (:8770) and reading the dereth TimescaleDB read-only. The live
Python stack is untouched (added via a compose override, not by editing the
tracked docker-compose.yml).

- Phase 0 scaffold: stdlib net/http server (Go 1.22+ method+path routing),
  /health + /api-version, multi-stage distroless Docker build, and
  go-services/docker-compose.go.yml override (loopback :8770).
- Phase 1: pgx v5 pool forced into read-only transactions, a 5s /live + /trails
  cache loop using the exact main.py:837 SQL, and Python-isoformat timestamps
  so output matches FastAPI's jsonable_encoder.
- compare/compare_live.py: parity harness vs the live Python service. Uses the
  server-stamped received_at to prove same-row full-field equality and to make
  the online-set diff boundary-aware.

Verified on live traffic (73 players): identical online set + 23-key schema,
identity/type parity for all, every same-row pair matches on every field, and
diff-row pairs differ only by the ~6s two-cache refresh skew.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

go-services/tracker-go/Dockerfile

@@ -0,0 +1,20 @@
+# Multi-stage build: compile a static Go binary, ship it on distroless.
+# No host Go toolchain required — everything happens inside the build stage.
+FROM golang:1.25-bookworm AS build
+WORKDIR /src
+
+# No local Go toolchain is available to maintain go.sum, so resolve and lock
+# dependencies inside the build (network is available here). `go mod tidy`
+# reads the imports from the source and writes go.mod/go.sum, then we build.
+COPY . .
+RUN go mod tidy
+ARG BUILD_VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags "-s -w -X main.buildVersion=${BUILD_VERSION}" \
+    -o /out/tracker-go .
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/tracker-go /tracker-go
+EXPOSE 8770
+ENTRYPOINT ["/tracker-go"]