vulngate: each program scanned on its own, in a process of its own

[aledbf]

On spin, go tool vulngate ./... peaked at 11.5 GB, and a plain govulncheck of ./... got OOM-killed at 10 GB while the gate ran. govulncheck builds one SSA program and call graph of everything it is handed, and the union costs far more than its parts. Measured on spin, 2026-10-13:

scan	peak RSS	time
./... at once (before)	11.5 GB	149 s
each binary alone	0.8 – 4.1 GB (largest: cmd/proxy, Caddy)	1 – 13 s
per program, in one process	7.9 GB (memory kept between runs)	131 s
per program, a process each (this PR)	4.2 GB	46 s

• vulngate expands the patterns with go list. Each main package becomes its own govulncheck run, plus one run of the named packages that no main imports. Findings from every run are judged together, so the rule is the same.
• Each run is vulngate re-executing itself (VULNGATE_SCAN=1), so a run's memory is given back when it ends.
• Flags are passed through and must be written -flag=value. -tags= also reaches go list.

mutate: 18 refused, 0 survived.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}