chore(ci): add shared-lib scaffolding and functional coverage gate

Bring the auth and logging libs up to the otelsetup/authz_client standard:
golangci-lint + .editorconfig + .testcoverage.yml + cliff.toml + renovate.json
+ CHANGELOG + CLAUDE.md + pre-commit and Release workflows. Replace the
minimal test-only CI with a cache-based coverage-regression gate (PR test job
restores main's baseline from the Actions cache; a non-gating post-merge
coverage-baseline job records it) mirroring the services (ADR-0010 carve-out).
Job names test/vulnerabilities preserved to match branch-protection contexts.

.gitea/workflows/pre-commit.yaml

@@ -0,0 +1,25 @@
+name: pre-commit
+permissions: read-all
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    env:
+      SKIP: no-commit-to-branch
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+      - name: Install goimports
+        run: go install golang.org/x/tools/cmd/goimports@latest
+      - uses: pre-commit/action@v3.0.1