Bring the Go SDK to parity with the .NET, Rust, TypeScript, and Python
SDKs by adding an in-process transport that hosts the runtime via the
native FFI library (runtime.node) instead of spawning a child process
for the runtime server.

- ffihost: pure-Go FFI host using ebitengine/purego (CGO stays off),
  C ABI binding, single-load-per-process guard, and cdylib resolution
  (flat name next to the CLI, or prebuilds/<platform>/runtime.node),
  including musl and Windows loaders.
- API: new InProcessConnection{Path, Args} (Experimental) plus
  connection-level Env on Stdio/TCP via a shared childProcessConnection
  interface.
- client: startInProcess wiring into Start/Stop/ForceStop/killProcess
  with no-PATH entrypoint resolution, --no-auto-update, and host
  ownership before the blocking handshake for cancellation safety.
  validateEnvironmentOptions rejects Env/WorkingDirectory/Telemetry
  in-process and env set in both client and connection for child
  transports.
- bundler + embeddedcli: extract and embed runtime.node (conditional
  per platform) and install it next to the CLI binary with SHA-256
  verification; add RuntimeLibPath().
- e2e: COPILOT_SDK_DEFAULT_CONNECTION=inprocess harness support that
  swaps only the default stdio connection, mirrors the merged env and
  cwd onto the process, and leaves TCP/URI/custom-stdio/telemetry tests
  on their transport; new in-process ping smoke test.
- CI: add transport: [default, inprocess] matrix to the Go workflow.
- Docs and unit tests for the new connection and validation semantics.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a96d1a82-c80e-40f1-a3df-a9708429b68b

Address three failure modes in the transport:[default,inprocess] matrix:

1. Snapshot path was cwd-relative. ConfigureForTest resolved snapshots via
   filepath.Abs, which broke once the in-process path chdir'd into the temp
   work dir, yielding empty snapshots ("No cached response"). Anchor the path
   to the caller's source directory instead.

2. Process-global LLM inference provider / per-client telemetry. The shared
   in-process runtime refuses a second provider client and ignores per-client
   telemetry. Rather than silently downgrade the transport, the 8 affected
   tests now skip explicitly via testharness.SkipIfInProcess (they still run
   over stdio in the default cell), mirroring Rust's skip_inprocess.

3. macOS SA_ONSTACK crash. libuv installs a SIGCHLD handler without SA_ONSTACK
   on first uv_spawn (during host_start); Go's runtime then aborts when it
   reaps its own os/exec children. Re-arm the foreign handler with SA_ONSTACK
   after host_start (sigonstack_darwin.go; no-op elsewhere), and gate the FFI
   smoke test to the inprocess cell so default cells never load libnode.

Also unset ambient HMAC keys at package init when inprocess (issue #1934).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a96d1a82-c80e-40f1-a3df-a9708429b68b

Resolve the remaining inprocess-cell failures in the go-sdk-tests matrix:

- Anchor all repo-relative test paths to source dirs, not the process cwd.
  The in-process transport os.Chdir's the whole test process into a per-test
  temp workdir, so cwd-relative resolution of the replay proxy (server.ts) and
  MCP server scripts (*.mjs) broke for every test after the first in-process
  one. Add testharness.RepoPath and use it for the proxy, CLI, and MCP paths.

- Fix a data race in ffihost.Host: `disposed` was written under disposeMu but
  read under callbackMu. Unify all disposed/serverID/connectionID/activeCallbacks
  access under a single mutex, which also fixes a real drain-ordering bug where a
  late onOutbound callback could feed the receive buffer after it was closed.

- Re-arm foreign signal handlers with SA_ONSTACK on linux too (not just darwin).
  libuv's SA_ONSTACK-less SIGCHLD handler makes the Go runtime abort when the
  test process reaps its own os/exec child (e.g. an MCP OAuth server) while
  libnode is loaded. Resolve sigaction through the runtime handle (with a libc
  dlopen fallback).

- Make the OAuth MCP server's stderr buffer thread-safe (syncBuffer): os/exec
  writes to it on a goroutine while the test reads String(), a -race violation.

- Skip only the readCheckpoint "unknown checkpoint" scenario in-process, where
  the native runtime decodes the id as u32 and rejects the large sentinel,
  matching Rust's explicit skip.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a96d1a82-c80e-40f1-a3df-a9708429b68b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 447feac4-35df-4c0b-ab34-00789ad78da7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 447feac4-35df-4c0b-ab34-00789ad78da7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 447feac4-35df-4c0b-ab34-00789ad78da7

Exclude the native runtime payload and purego implementation from normal Go application builds while enabling them with copilot_inprocess.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 447feac4-35df-4c0b-ab34-00789ad78da7

Forward typed runtime options, make Go startup cancellation safe, select musl runtime packages, and correct the Go replay harness working directory.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 447feac4-35df-4c0b-ab34-00789ad78da7