test(acceptance): subprocess acceptance test harness for healthcheck

Context

This MR is one piece of a broader effort to build contract tests for gitlab-shell that prove its API integrations behave correctly at the wire level — not just at unit-test seams.

The goal: enough confidence to deploy and manage gitlab-shell as an independent service. Today, refactoring the HTTP clients (e.g. the healthcheck migration in MRs !1465 (merged)–!1467 (merged)) relies on integration tests in the gitlab Rails app to catch wire-level regressions. With a subprocess-based harness that exercises real binaries against fake upstreams, gitlab-shell can validate its own contracts in-repo, decoupled from the monolith's CI.

This MR establishes the harness and locks in the /check contract. Future MRs extend the same pattern to other gitlab-shell commands.

What this MR does

Adds an acceptance test harness that compiles the real gitlab-shell-check binary in a subprocess and drives it against fake HTTP servers (via net/http/httptest), proving both the legacy and new client paths handle the API contract at the wire level.

What's included

• acceptance/acceptancetest/ — generic harness: binary build cache (sync.Once per name), subprocess runner (exec.CommandContext with SIGINT+WaitDelay), config.yml templating
• acceptance/healthcheck/ — 2×2 test matrix: FF-off/FF-on × api_healthy/api_500, with JWT auth-gating and User-Agent assertion on the healthy rows
• Makefile: acceptance-test target (go test -tags=acceptance)
• New direct dep: github.com/open-feature/go-sdk (promoted from indirect; used for FF evaluation context)
• Fake servers use stdlib net/http/httptest — no external fake/mock framework

Test plan

• make acceptance-test

---

Stack

Earlier MRs in this stack are now merged:

#	MR	Status
1	!1465 (merged) — retry policy	✅ merged
2	!1466 (merged) — new HealthcheckClient	✅ merged
3	!1467 (merged) — FF-gated dispatch	✅ merged
4	!1468 (merged) — acceptance test harness ← you are here	targets main