fix(ci): let the template test itself, and cover the entrypoint ./... cannot see

Closes #12.

The guard that stops this template building itself also stopped it TESTING
itself: check, build and deploy were all gated on is_template, which is always
true here. So the repo that mints every other repo was the one repo with no
working gate — and #8 sat in it for months with CI green throughout, found
eventually by a child rather than by us.

check is now ungated. build and deploy stay gated, because they genuinely
cannot work here: placeholder module path, no image name, no namespace.

Ungating alone would have been a false fix. `go build ./...`, `go vet ./...`,
`go test ./...` and `golangci-lint run ./...` cannot see cmd/__PROJECT_NAME__
at all — Go skips directories whose names begin with an underscore when
expanding package patterns:

    $ go list ./...
    __MODULE_PATH__/internal/web        <- no cmd package

So a newly-ungated check would still have skipped the package every generated
repo is built around.

scripts/tests/generated-child_test.sh substitutes the tracked tree into a
throwaway child and gates the result: templ generate, go list, build, vet,
golangci-lint. Ported from template-go-agent, plus a templ step, which also
proves the pinned generator and pinned library agree.

Proven to fail when it should. With a deliberate errcheck violation added to
the entrypoint:

    generated-child harness -> FAIL cmd/childproj/main.go:12:26 errcheck
    golangci-lint run ./... -> "0 issues."

The existing gate calls the same broken code clean. That contrast is the
reason this harness exists rather than a wider lint invocation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Taskfile.yml

@@ -27,6 +27,10 @@ tasks:
       # The template guard decides whether CI runs at all in every child repo,
       # so its regression test belongs in the same gate as the Go tests.
       - bash scripts/tests/is-template_test.sh
+      # The three Go commands above cannot see cmd/__PROJECT_NAME__ -- Go's
+      # ./... expansion skips directories whose names start with an underscore.
+      # This gates the substituted result, which is what a child actually runs.
+      - bash scripts/tests/generated-child_test.sh
 
   context:sync:
     desc: Regenerate all harness-specific context files