feat(build-time-versioning): go_build injects commit/build-time via ldflags

Reads XCE_GIT_COMMIT/XCE_BUILD_TIME from the environment (empty-safe via
[ -z ... ], not just unset-safe -- a classic ${VAR:-default} gotcha
avoided), falls back to "unknown", and appends
-ldflags "-X main.GitCommit=... -X main.BuildTime=..." to the go build
invocation alongside the existing -gcflags.

Confirmed via live testing: -X on a main package var that doesn't exist
yet is silently ignored by the Go linker (not a build error), so this
task has no real ordering dependency on tasks 4.4/4.5 (which add the
consuming vars to apiserver/xcecli).

Task 4.1/13 of build-time-versioning.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/tools/go_build

@@ -99,4 +99,15 @@ done
 
 export GOPROXY=https://goproxy.cn
 
-(cd $_sdir; go build -gcflags "all=-N -l" -o "$_dfile" "$_sfile")
+_git_commit="$XCE_GIT_COMMIT"
+_build_time="$XCE_BUILD_TIME"
+
+if [ -z "$_git_commit" ]; then
+    _git_commit=unknown
+fi
+
+if [ -z "$_build_time" ]; then
+    _build_time=unknown
+fi
+
+(cd $_sdir; go build -gcflags "all=-N -l" -ldflags "-X main.GitCommit=$_git_commit -X main.BuildTime=$_build_time" -o "$_dfile" "$_sfile")