converge-relay: phase 1 — webhook-to-SSE relay server in Go

- Pub/sub broker with fan-out to SSE clients
- POST /webhook — receives Gitea push events, optional HMAC verification
- GET /events — SSE stream of push events
- GET /health — health check endpoint
- Zero external dependencies (stdlib only)
- Docker-based build via goctl wrapper (golang:1.26-alpine)
- systemd unit, README with deployment docs
- Tests: broker pub/sub, slow subscriber drop, ref parsing, signature verification
- 6.0M static binary

converge-relay/goctl

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Thin wrapper to run Go tooling inside a golang:1.26-alpine Docker container.
+# Usage: ./goctl go build ./..., ./goctl go test ./..., ./goctl go fmt ./...
+set -euo pipefail
+
+IMAGE="${CONVERGE_GO_IMAGE:-golang:1.26-alpine}"
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+GO_CACHE="${PROJECT_DIR}/.go-cache"
+mkdir -p "${GO_CACHE}/mod" "${GO_CACHE}/build"
+
+exec docker run --rm -i $([ -t 0 ] && printf -- -t) \
+  -v "${PROJECT_DIR}:/work" \
+  -v "${GO_CACHE}/mod:/go/pkg/mod" \
+  -v "${GO_CACHE}/build:/root/.cache/go-build" \
+  -e GOMODCACHE=/go/pkg/mod \
+  -e GOCACHE=/root/.cache/go-build \
+  -w /work \
+  "${IMAGE}" \
+  "$@"