Port awg-agent to Go: awg-control agent

- internal/agent: outbound WSS to core with SPKI pin checked inside the TLS
  handshake, Ed25519 challenge-response, one-shot join secret (dropped from
  memory and cli.env after the first ready), forwarding of core requests to the
  local awg-ctrl with an internal token, dead-connection timer on pings,
  backoff up to a minute (a minute after 4003)
- path filter is stricter than the Node one where it relied on WHATWG URL
  normalisation: backslashes, a leading "//" and %2e dot segments are rejected
- tests: end-to-end against a fake TLS core and a fake awg-ctrl; also checked
  by hand against the real awg-ui/nodes.ts hub
- CI: Go build, vet and race tests on GitHub and Gitea

.github/workflows/ci.yml

@@ -23,6 +23,18 @@ jobs:
       - name: Installer syntax
         run: bash -n install.sh
 
+      # Go-переписывание (awg-control): сборка, vet и тесты. composites выключен —
+      # jsjson.KV{k, v} без имён полей написан так намеренно.
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Go build, vet, test
+        run: |
+          go build ./...
+          go vet -composites=false ./...
+          go test -race ./...
+
       - name: awg-ctrl types
         working-directory: awg-ctrl
         run: |