feat(go): add TLS integration tests and examples

[saie-ch]

Which issue does this PR close?

Closes #2807

Rationale

The Go SDK lacked TLS integration tests to verify encrypted TCP connections work correctly. Python and other SDKs have similar tests using
testcontainers for portable, self-contained testing.

What changed?

Before: Go SDK had no tests for TLS connections.

After: Added 3 integration tests using testcontainers that verify:

1. TLS connections with CA certificates succeed
2. Non-TLS connections to TLS servers are rejected
3. Complete message flows (create stream/topic, send/poll messages) work over TLS

Tests use apache/iggy:edge Docker image by default (overridable via IGGY_SERVER_DOCKER_IMAGE env var) with testcontainers-go v0.32.0. In CI, the image is built from the current PR code using docker-build-test-server action.

Also:

• Updated getting-started examples with TLS flags
• Enhanced test script to run both non-TLS and TLS passes
• Upgraded golangci-lint from v1.64.8 to v2.11.3 (required for Go 1.25 compatibility)
• Upgraded golangci-lint-action from @v6 to @v7 (required for lint v2)
• Separated unit tests from integration tests in CI (test vs e2e tasks)
• Fixed connection leak in TLS config error path (tcp_core.go)

Breaking change: Bumped Go requirement from 1.23.0 to 1.25.0 (required by testcontainers-go dependency). Go 1.25.0 was released 6 months ago and is stable.

Local Execution

All TLS integration tests passed locally:
Ran complete pre-merge check suite (format, tidy, lint, tests) - all passed.

AI Usage

Claude Code (claude-sonnet-4.5)

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.24%. Comparing base (3f651e0) to head (f389931).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
foreign/go/client/tcp/tcp_core.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2898      +/-   ##
============================================
- Coverage     70.27%   70.24%   -0.03%     
  Complexity      862      862              
============================================
  Files          1028     1028              
  Lines         85279    85280       +1     
  Branches      62656    62665       +9     
============================================
- Hits          59932    59909      -23     
- Misses        22833    22847      +14     
- Partials       2514     2524      +10     

Flag	Coverage Δ
csharp	67.43% <ø> (-0.19%)	⬇️
go	36.36% <0.00%> (-0.01%)	⬇️
java	59.87% <ø> (ø)
node	91.37% <ø> (-0.15%)	⬇️
python	81.43% <ø> (ø)
rust	70.64% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
foreign/go/client/tcp/tcp_core.go	47.74% <0.00%> (-0.22%)	⬇️

... and 11 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[atharvalade]

overall lgtm but the foreign/go/client/tcp/tcp_core.go‎ is critical imo rest are just for codebase consistency

[atharvalade]

lgtm now! thanks @saie-ch