Vendor setup tool binaries

README.md

@@ -0,0 +1,15 @@
+# Vendored development tools
+
+`make setup` uses the Linux amd64/arm64 binaries in `tools/bin/` instead of downloading tools.
+
+Versions are pinned in the top-level `Makefile`:
+
+- golangci-lint v2.12.2
+- lefthook v2.1.6
+- gitleaks v8.30.1
+- govulncheck v1.3.0
+- deadcode v0.31.0
+
+`golangci-lint`, `lefthook`, and `gitleaks` are copied from their upstream release archives. `govulncheck` and `deadcode` are built from the pinned Go module versions. SHA-256 hashes are in `tools/SHASUMS256.txt`.
+
+These binaries are intended to be tracked through Git LFS via the repository `.gitattributes` rule for `tools/bin/**`.

SHASUMS256.txt

@@ -0,0 +1,10 @@
+109e27c706583a33343431972267a0c3aaeb260dbfae19bfe722f33539db0374  tools/bin/linux-amd64/deadcode
+88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509  tools/bin/linux-amd64/gitleaks
+e26335d9bd381a60e5769a13b0ccc7967db5b6fb9c39a896a1f6fd0befe0a661  tools/bin/linux-amd64/golangci-lint
+01944b647aab052e0a0e7d2300d45ae8729fc8392e2575a4631b19b67fe209af  tools/bin/linux-amd64/govulncheck
+3c0b5f8a98f5115f7fa73ea563f420f23003e4a31a6ce52e3cac0aae5f2693fb  tools/bin/linux-amd64/lefthook
+f2664cb4961fa1e4140403930067d6a6d1b6ef97774008ce2a514f1bc3dd194e  tools/bin/linux-arm64/deadcode
+00e91bbe655bd7c47753e8cfe61cb76ea1a5d7e7702fe161ee40102b46b3823b  tools/bin/linux-arm64/gitleaks
+66dbbe60d3e1fc6b07807be7cbe58fe9ed45afe190018fba2112870e2e30b737  tools/bin/linux-arm64/golangci-lint
+a82af0e0fe1e84a4fb2aa5e26c051ad67c125214efc28a096225d23d2b540240  tools/bin/linux-arm64/govulncheck
+2c8dae606292552256e9d077189ab8a9c07fdfd960cc7aeda608b8090d2cebc2  tools/bin/linux-arm64/lefthook