Docs: document how vg scan --vulns treats Go pseudo-versions

[vibgrate-team]

Context

Go modules often use pseudo-versions (v0.0.0-yyyymmddhhmmss-abcdef) and +incompatible tags. Adjacent scanners frequently mis-match these against advisory ranges (false positives/negatives). Contributors and CI authors need Vibgrate-specific docs for how local vg scan --vulns resolves Go versions against the advisory corpus — without implying network lookup unless the user opts in.

What to do

1. Document observed matching rules for:
   • pseudo-versions vs tagged releases
   • +incompatible major versions
   • replace/exclude directives (high level; point to graph/scan behavior)
2. Include a short “how to verify locally” snippet with vg (fixture or minimal go.mod example).
3. Call out honest limitations and how to file a false-positive with a reproducible local repro.

Acceptance

• Docs explain Go pseudo-version / +incompatible handling in vg scan --vulns in contributor-friendly language
• Local-first: no secret-bearing registry auth in examples
• Links to related issues (Test: add Go module workspace (go.work) fixture for vg build #243 go.work fixture, roadmap Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144) where useful
• DCO on commits