Legacy Go implementation

The original Go implementation remains in legacy/go/ as a reference and compatibility target while the production binary is built from the Rust workspace. It is not part of the default build, install, service, release, or Docker test paths. Run make legacy-build only when comparing behavior during the migration; the target is intentionally labelled as quarantined.

New security fixes and features belong in the Rust crates under crates/.