refactor: switch to go everywhere

[jdrean]

Summary by cubic

Rewrote Modelwrap in Go and added a modelwrap launcher CLI that runs packing inside a digest‑pinned container for reproducible MWP/EMWP artifacts. Removes the Python packer and adds end‑to‑end tests plus CI/release automation.

• New Features

  • Go module with wrap (packer), unwrap (consumer), and a root package for shared protocol/constants.
  • modelwrap CLI: launches a pinned image by default; supports --model-dir, --encrypt, --verify, --output/--cache, --image, and --local. Secrets like HF_TOKEN are passed via env without leaking to command lines.
  • Multi‑stage Dockerfile builds a static Go CLI; runtime is a minimal, pinned image with huggingface_hub (hf) for downloads; entrypoint is modelwrap.
  • CI runs gofmt/vet/tests in the same pinned Go image and executes an EMWP round‑trip plus CLI smoke test via test/e2e.sh. Release pushes a linux/amd64 packer image, builds a CLI with the image digest baked in, and publishes a GitHub release with checksums.
  • SPEC documents that reproducibility is tied to the specific digest‑pinned packer image; auditors must use the same digest.

• Bug Fixes

  • Correctly escape Hugging Face model IDs when calling the Hub API to resolve the default branch SHA, preserving org/name separators and encoding special characters.

^{Written for commit dfb4d74. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 20 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>