Copilot instructions for Go

# GitHub Copilot instructions

These instructions apply to the whole Go repository. Copilot reads them from `.github/copilot-instructions.md`.
Prefer the commands and layout below over guesses.

## Stack

This repository is a Go module. Format with gofmt, keep the standard library first, and pass context through exported I/O.

## Layout

- Packages are small and named for what they provide, not `util`.
- `cmd/` holds binaries. Importable code lives in other packages.
- Internal packages stay under `internal/` when the module already uses that boundary.

## Commands

- Test: `go test ./...`
- Format: `gofmt -w .`
- Vet: `go vet ./...`
- Build: `go build ./...`

Use the script the repo already defines when it differs from the command above.

## Conventions

- Run gofmt on every change. Do not hand-align code in a way gofmt will undo.
- Accept interfaces, return concrete types, unless the package already does otherwise.
- Pass `context.Context` as the first argument after the receiver on I/O that can be cancelled.
- Wrap errors with `%w` when the caller should use `errors.Is` or `errors.As`.
- Handle errors where they happen. Do not assign them to `_`.
- Exported names have a doc comment when the package is imported by other modules.

## Testing

Add or update tests when behavior changes.

Prefer table-driven tests in the same package. Cover the success path and one failure.

## Style

- Optimize for the next reader over the shortest diff.
- Comment only when the why is non-obvious.
- Name things the way neighboring files already do.
- Do not reformat code you did not change.

## Errors

- Fail at the boundary. Do not swallow errors.
- Return `error`. Wrap it with enough context to know which operation failed. Do not log and return the same error unless the caller cannot see the log.

## Scope

- Do the requested task. Do not refactor unrelated code.
- Match the rigor already in the repo. Fix what you touch.
- Ask one clarifying question only when the task cannot be finished without it. Otherwise state the assumption and continue.

## Avoid

- Do not panic for a normal error path.
- Do not start a goroutine without a way to finish it.
- Do not share a map across goroutines without synchronization.
- Do not add a framework for a handler the standard library already serves.

## Done when

- The requested behavior works.
- `gofmt` leaves the tree clean and `go test ./...` passes.
- The diff stays inside the task.
- You list anything you could not run.

## Review checklist

- The change matches the commands and layout in this file.
- No new dependency was added without a reason already present in the repo.
- Do not log secrets when wrapping errors.
- Set timeouts on outbound HTTP. Do not use http.DefaultClient for untrusted URLs.
- Compare secrets with subtle.ConstantTimeCompare when the value is a token.