Compile baked safety-profile policies into generated hash switches so the raw allow/deny rule strings are no longer embedded as a patchable YAML blob.
Verification before merge:
- `go test ./cmd/bake-safety-profile ./internal/safetyprofile ./internal/cmd`
- `make lint`
- `./build-safe.sh safety-profiles/agent-safe.yaml -o bin/gog-agent-safe-review`
- `./build-safe.sh safety-profiles/readonly.yaml -o bin/gog-readonly-review`
- runtime block checks for agent-safe and readonly baked binaries
Co-authored-by: drewburchfield <drewburchfield@gmail.com>
- Import time/tzdata in cmd/gog/main.go to bundle the IANA tz database
into the binary (~450KB), fixing time.LoadLocation on Windows
- Add tzdata_test.go verifying LoadLocation works for representative zones
- Add windows-latest CI job running the full gate (fmt, lint, test, build)
