Roll out default-branch Go maintenance checks and retire the opt-in

[devantler]

🤖 Generated by the Agentic Engineer

Outcome

Adopt the maintenance-default-branch input introduced for #908, then remove the temporary rollout flag after real default-branch evidence. Part of #558.

Acceptance criteria

• Enumerate current validate-go-project.yaml callers and their actual default-branch triggers.
• Opt in pilot callers after the shared repair is released, using pinned Actions revisions.
• Record current-head default-branch pushes with Go changes where tidy and dead-code analysis both run; include clean results and controlled finding rejection without default-branch writes.
• Check feature-branch and pull-request behavior, renamed default branches, and merge-queue exclusions.
• Roll out to remaining callers with their own review and CI evidence.
• Flip the default only once rollout evidence supports it, then remove the input, its concurrency discriminator, and obsolete flag-state fixtures while preserving behavior coverage.

The flag remains false until the rollout is validated. No caller changes are implied by creating this task. Rough size: M.

[devantler]

🤖 Generated by the Agentic Engineer

The shared capability is released in v13.4.0, revision d36022b, after #1171 merged with green CI and finding-free current-head CodeRabbit review. The flag remains false.

Caller audit on 2026-09-06: indexed organization code searches for the exact reusable-workflow reference, across both .yaml and .yml, returned one explicit caller (not an inventory of org-required direct workflow runs). Verified the public, active KSail repository at de9f8c01ac53bfd06eb8768979d08e8d5854dfce: its ci-go job runs on main pushes, pins Actions 4f4e07a, enables scan-default-branch and test-default-branch, and omits maintenance-default-branch. This is the concrete pilot candidate; no caller was changed in this pass.

The pilot slice should update the immutable Actions pin and pass maintenance-default-branch: true, then record the next main push that actually changes Go files. A YAML-only pin/flag update cannot prove tidy/deadcode execution because the Go-change filter intentionally skips those jobs. Acceptance needs both jobs to have run, their clean/finding behavior, and confirmation that no default-branch fix commit was created. The shared fixture already proves the actual commands reject untidy and unreachable-code inputs without committing; consumer push evidence remains outstanding before a default flip.