Fix broken internal doc links, shrink test script, CI SHA pinning, and Go test skipping #825

Problem

I identified several broken references, missing test coverage, CI supply-chain inconsistencies, and test runner gaps across the workspace:

1. Broken relative doc links: Multiple markdown files link to internal monorepo paths (docs/decisions/*, docs/prd/*, docs/CAVEMAN_LEARN_SPEC.md, docs/FASTCONTEXT_EXPLORER_SPEC.md, docs/research/*, PRODUCTS.yaml, examples/coding-agent) that were omitted from the open-source mirror, leading to 404s for external contributors.
2. Missing shrink package test script: shrink/package.json lacks a "test" script, causing pnpm -r test to silently skip the package entirely.
3. Unpinned Actions in CI: .github/workflows/ci.yml uses floating tags (actions/checkout@v4, actions/setup-node@v4, actions/setup-python@v5) while all other workflows (engine-ci.yml, release-*.yml) enforce immutable commit SHA pinning.
4. Hard test failures when Go is not installed: In packages/cli, 10 runtime tests throw spawnSync go ENOENT instead of gracefully skipping with t.skip("go toolchain not found") when executed in a JS/Node-only development environment.
5. Silent catch (e) {} blocks: Several fs.unlinkSync calls in hooks swallow errors without debug visibility.

Proposed Solution

• Replace unresolvable relative markdown links with plain text references across package documentation.
• Add "test": "node --test tests/*.test.mjs" and package smoke tests to shrink/.
• Pin all Actions in .github/workflows/ci.yml to full commit SHAs with version comments.
• Add Go toolchain existence checks in packages/cli runtime tests to skip cleanly when Go is absent.
• Add if (process.env.CAVEMAN_DEBUG === '1') console.error(...) to empty catch blocks around flag file cleanup.