ci: unbreak pkg/lockdown build and remove broken/redundant workflows

[israel2606]

What & why

main currently has four red workflows. Three of them — golangci-lint, go.yml (Build and Test Go Project), and go-build.yml (Go Build and Test) — share a single root cause: pkg/lockdown no longer compiles.

The lockdown package was refactored in PR #6, which merged before PR #5. The safety_coverage_test.go that #5 added still referenced the old API that #6 removed:

pkg/lockdown/safety_coverage_test.go:26: undefined: newSafetyTestCache
pkg/lockdown/safety_coverage_test.go:30: unknown field viewerLogin in repoAccessCacheEntry
pkg/lockdown/safety_coverage_test.go:71: queryRepoAccessInfo signature changed (now returns 3 values)

This is a semantic conflict git did not catch on merge (the file was new, so there was no textual conflict). lockdown_test.go already covers the refactored design, so the obsolete file is removed.

Changes

Change	Fixes
Delete obsolete pkg/lockdown/safety_coverage_test.go	golangci-lint, go.yml, go-build.yml (the compile error)
Delete .github/workflows/python-package.yml	It's an empty deprecation stub with no jobs: — an invalid workflow that always reports failure
Delete .github/workflows/go-build.yml	Redundant with go.yml; built on Node20-deprecated actions (setup-go@v4, cache@v3) that break after 2026-06-16

No production code changes.

Verification (local)

go mod tidy -diff   # clean
script/test         # all packages pass, incl. pkg/lockdown
go vet ./...        # clean

Note

PR #6's refactor replaced the design that PR #5's tests targeted, so lockdown statement coverage is back to ~79%. Re-adding coverage for the new RepoAccessCache design (REST-based push-access check, viewerLoginFor, etc.) is a worthwhile follow-up but is out of scope here — this PR is strictly about getting CI green.

🤖 Generated with Claude Code

---

Generated by Claude Code

[israel2606]

Cerrado como duplicado de #9, que ya fue fusionado en main. El #9 elimina el mismo archivo obsoleto (pkg/lockdown/safety_coverage_test.go) y, en lugar de borrar go-build.yml, actualiza setup-go a v6 para arreglar covdata. Por eso este PR (que además tenía conflictos de fusión) ya no es necesario.