Add checkergen module for reflection-free code generation

[cinar]

Summary

Implements #264 per the revised scoping comment: a code generator that turns checkers/validate struct tags into a reflection-free Check<Type>(v *Type) (checker.CheckErrors, bool) function, calling the same plain checker/normalizer functions (IsEmail, MinLen[string](8), IsEqField, ...) directly instead of walking the struct with reflect through CheckStruct.

• New isolated checkergen/ module (own go.mod, taskfile.yml, replace ../), needs golang.org/x/tools (go/packages) for type info — same pattern as checkerlint
• Self-contained per-checker call-spec mapping table lives in checkergen itself, not the core module — emitting Go source text is a different concern than reflecting into a Schema, so the core module's job stays unchanged
• v1 scope: a field is only eligible if its Go type is exactly one of the predeclared scalar types — not a named/defined type, a pointer, or a nested struct/slice/map. A struct with an ineligible field or unmapped checker is skipped with a clear diagnostic, not generated incorrectly, and doesn't block generation for the rest of the package
• A malformed tag parameter panics the same way the equivalent runtime maker does; Generate recovers this per-struct into a skip, mirroring the cli module's CheckWithConfig panic recovery (documented pattern in CLAUDE.md)

Two deliberate, documented divergences from CheckStruct

• eq-field's generated call uses == (comparable), matching IsEq/IsGte's style, instead of the reflect path's reflect.DeepEqual — only differs for a slice/map/struct field, which isn't eligible for generation anyway
• eq/ne/oneof generated calls support any comparable field type via the fully generic IsEq/IsNe/IsOneOf, even though CheckStruct's own reflect-based implementation only supports string fields today (checkEq/checkNe/checkOneOf hardcode reflectString) — a capability superset, not a behavior change for anything CheckStruct already validates correctly

Verification

• Differential tests (testdata/fixture): for a battery of inputs, generated code and checker.CheckStruct are asserted to report errors under identical field keys and normalize values identically
• Drift test: regenerates the committed fixture into a scratch copy and byte-compares it against the checked-in version, to catch the fixture falling out of sync with the generator
• 96.7%/98.2% test coverage (package/overall)

Performance

Benchmarked against CheckStruct on the same struct/input: ~3x faster, 4-8x fewer allocations. Numbers in both checkergen/README.md and the root README's new "Code Generation" section.

Also fixes along the way

• An unrelated gosec finding (G306) this surfaced: tightened checkergen's generated-file write permission to 0600
• Added -exclude-dir=checkergen to the root taskfile.yml's gosec run proactively this time, plus a loud warning comment in CLAUDE.md about updating both places — learned from the nethttp/fiber miss that broke main's CI after Add a Fiber adapter module #276

Closes #264

Test plan

• cd checkergen && go test -cover . — 96.7% coverage
• cd checkergen && go vet ./..., gosec, staticcheck, revive — all clean
• Root go test -cover ./... — 100%, unaffected
• Root gosec run (with the updated exclude list) verified clean from the actual repo root, run multiple times to rule out flakiness
• Benchmarks run 3x for stability — consistent ~3x speedup, 4-8x fewer allocations

🤖 Generated with Claude Code

https://claude.ai/code/session_01ARLam6G4Bu9afnWHpmJWeo

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (c127c4b) to head (7fd2654).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #282   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           86        86           
  Lines         1807      1807           
=========================================
  Hits          1807      1807           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.