Make the vendored Go toolchain self-sufficient so make test exits 0

`make test` failed with `go: no such tool "covdata"` on the two packages that
have no test files (cmd/mavenclient, cmd/mavend/seedtest), even though every
package passed. A permanently-red test target trains you to ignore the exit
code, which is the signal protecting the whole suite.

The cause was not a truncated download. Go >=1.24 ships only 7 prebuilt GOROOT
tools; covdata, pprof, test2json, nm, objdump and trace ship as source and are
built on demand. `go tool covdata` has that build-on-demand fallback, but the
`-coverprofile` merge path goes through base.Tool(), which only stats
pkg/tool and exits. deps/go was go1.23.4 against a `go 1.25.5` directive, so
GOTOOLCHAIN=auto re-exec'd into a downloaded toolchain module and inherited
the gap.

deps/go now holds a checksum-verified go1.25.5 with those 8 tools built in
from its own source. Pin GOTOOLCHAIN=local so a future go.mod bump cannot
silently re-exec into a tool-poor module toolchain again, and add a deps-go
target so the install is reproducible rather than hand-placed — which was the
point of vendoring it. pprof works now too, which matters on a
latency-sensitive box.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5JApcrCRVGmqrxnhynSik

Makefile

@@ -1,4 +1,12 @@
+# GOTOOLCHAIN=local pins us to the vendored deps/go tree. Without it, a go.mod
+# `go` directive newer than deps/go re-execs into a downloaded toolchain module,
+# and those ship only 7 of the 15 GOROOT tools (no covdata) -- which makes
+# `test` below fail on the two packages that have no test files. deps-go builds
+# the missing tools in, so the vendored tree is self-sufficient. Keep the version
+# here in step with the `go` directive in go.mod.
+GO_VERSION := 1.25.5
 GO       := $(shell pwd)/deps/go/go/bin/go
+export GOTOOLCHAIN := local
 GOFLAGS  :=
 CGO_LDFLAGS := -L$(shell pwd)/deps/lib -Wl,-rpath,$(shell pwd)/deps/lib
 CGO_CFLAGS  := -I$(shell pwd)/deps/include -I$(shell pwd)/deps/whisper.cpp/ggml/include
@@ -8,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test run-stt run-tts run-web download-embedder
+.PHONY: all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test run-stt run-tts run-web download-embedder deps-go
 
 all: build
 
@@ -45,6 +53,22 @@ build-caldav:
 run-web: build-web
 	./mavweb -addr :9200 -voice 127.0.0.1:9100
 
+# Install the vendored Go toolchain from scratch. Go 1.24+ release tarballs no
+# longer ship covdata/pprof/test2json/nm/objdump/trace prebuilt -- `go tool X`
+# builds them on demand, but `go test -coverprofile` calls covdata through
+# base.Tool(), which only stats pkg/tool and exits. So build them in once here.
+GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
+GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+deps-go:
+	@mkdir -p deps/go
+	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
+	cd deps/go && echo '$(GO_SHA256)  $(GO_TARBALL)' | sha256sum -c -
+	cd deps/go && rm -rf go && tar xzf $(GO_TARBALL) && rm $(GO_TARBALL)
+	cd deps/go/go/src && for t in covdata pprof test2json nm objdump trace addr2line buildid; do \
+		GOROOT="$(shell pwd)/deps/go/go" $(GO) build -o "$(shell pwd)/deps/go/go/pkg/tool/linux_amd64/$$t" "cmd/$$t" || exit 1; \
+	done
+	$(GO) version
+
 test:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...