fix(ci): let the template test itself, and cover the entrypoint ./... cannot see

Closes #12.

The guard that stops this template building itself also stopped it TESTING
itself: check, build and deploy were all gated on is_template, which is always
true here. So the repo that mints every other repo was the one repo with no
working gate — and #8 sat in it for months with CI green throughout, found
eventually by a child rather than by us.

check is now ungated. build and deploy stay gated, because they genuinely
cannot work here: placeholder module path, no image name, no namespace.

Ungating alone would have been a false fix. `go build ./...`, `go vet ./...`,
`go test ./...` and `golangci-lint run ./...` cannot see cmd/__PROJECT_NAME__
at all — Go skips directories whose names begin with an underscore when
expanding package patterns:

    $ go list ./...
    __MODULE_PATH__/internal/web        <- no cmd package

So a newly-ungated check would still have skipped the package every generated
repo is built around.

scripts/tests/generated-child_test.sh substitutes the tracked tree into a
throwaway child and gates the result: templ generate, go list, build, vet,
golangci-lint. Ported from template-go-agent, plus a templ step, which also
proves the pinned generator and pinned library agree.

Proven to fail when it should. With a deliberate errcheck violation added to
the entrypoint:

    generated-child harness -> FAIL cmd/childproj/main.go:12:26 errcheck
    golangci-lint run ./... -> "0 issues."

The existing gate calls the same broken code clean. That contrast is the
reason this harness exists rather than a wider lint invocation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -34,8 +34,16 @@ jobs:
 
   check:
     name: Lint / Test / Vet
+    # Deliberately NOT gated on the guard (#12). build and deploy are, because
+    # they genuinely cannot work here -- placeholder module path, no image name,
+    # no namespace. But linting and testing the template is meaningful, and
+    # gating it meant this repo had no working gate at all: #8 sat here with CI
+    # green throughout, and was found by a child rather than by us.
+    #
+    # `task check` includes scripts/tests/generated-child_test.sh, which covers
+    # the entrypoint that ./... cannot see -- ungating without that would run a
+    # gate that still skips the package every child is built around.
     needs: guard
-    if: needs.guard.outputs.is_template != 'true'
     runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4