feat(go-services): discord-go — Go port of discord-rare-monitor

Consumes the Python tracker's /ws/live firehose (subscribed to rare+chat),
classifies rares common/great, posts embeds + relays allegiance chat.

- classify.go: the 74-name common-rares set, extracted verbatim from the Python
  COMMON_RARES_PATTERN (not hand-transcribed). go test runs at build time; a
  server-side dump-rares vs the Python regex confirms the sets are IDENTICAL.
- poster.go: a `poster` interface with a real discordgo impl (REST sends by
  channel id; gold/blue embeds, location/time fields, icon attachment) and a
  dry-run log impl.
- ws.go: coder/websocket client to /ws/live with subscribe, ping keepalive,
  exponential-backoff reconnect; rare/chat dispatch incl. vortex-warning + the
  MONITOR_CHARACTER filter.
- SAFE BY DEFAULT: dry-run unless a token AND DRY_RUN=0 are set, so it can never
  double-post to production. Deployed via the compose override
  (discord-rare-monitor-go), running dry-run against the same live firehose.

Validated on the server: connects, subscribes, relays a real chat in dry-run;
classifier parity 74/74 vs the Python regex.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

go-services/discord-go/Dockerfile

@@ -0,0 +1,14 @@
+# Multi-stage build for the Go discord-rare-monitor port. The unit test (rare
+# classification) runs at build time, so a classifier regression fails the build.
+FROM golang:1.25-bookworm AS build
+WORKDIR /src
+COPY . .
+RUN go mod tidy
+RUN go test ./...
+ARG BUILD_VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w" -o /out/discord-go .
+
+# distroless/static includes CA certificates (needed for Discord's HTTPS REST API).
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/discord-go /discord-go
+ENTRYPOINT ["/discord-go"]