go-pr-analysis: govulncheck runs with continue-on-error, so findings never fail CI #910

Problem

go-pr-analysis.yml runs govulncheck with continue-on-error: true (step "Run govulncheck", right after "Install govulncheck", at tier-2). A known vulnerability in a consumer's dependency graph therefore leaves the job green. Every Lerian Go repository on this channel reads "security passed" without proof that govulncheck passed.

Evidence

Found while reviewing LerianStudio/lerian-llms-proxy CI (it calls go-pr-validation.yml@tier-2, which runs this analysis). No reachable vulnerability is shown today; the gap is that the gate cannot report one.

Proposed fix

Remove continue-on-error: true from the "Run govulncheck" step, or make it an input that defaults to failing. Before flipping the default, run the analysis against the consumers on the tier-2 channel and fix or explicitly accept what it reports, so the change does not turn every consumer red at once.