Replace the legacy Go implementation as the production path, quarantine the reference tree, add deterministic release packaging and version metadata, and run verification through GitLab CI.
Legacy Go implementation
The original Go implementation remains in legacy/go/ as a reference and
compatibility target while the production binary is built from the Rust
workspace. It is not part of the default build, install, service, release, or
Docker test paths. Run make legacy-build only when comparing behavior during
the migration; the target is intentionally labelled as quarantined.
New security fixes and features belong in the Rust crates under crates/.