docs: add AI-era authorship conventions to go-testing.md

Why

AI agents author most code and tests in the Artifact Registry under engineer review. When the same agent writes both implementation and tests, the tests tend to ratify the implementation's bugs rather than catch them. Perry (2023), Siddiq and Santos (2024), and GitClear (2024) document the pattern, though none isolate the failure mode for a single agent authoring both. The existing docs/dev/go-testing.md covered mechanics but nothing about authorship or the techniques that break the correlated blind spot.

This work was originally proposed as a handbook ADR (gitlab-com/content-sites/handbook!19437 (closed)). The content is a development practice rather than an architectural decision, and docs/dev/ is where testing conventions already live. That MR is being closed in favor of this one.

What

The new content sits in four sections (Authorship, Technique selection, Property-based testing with pgregory.net/rapid, and Fuzzing for parsers and untrusted input), inserted before and between the existing mechanics. Existing content (table-driven tests, subtests, helpers, assertions, HTTP handler testing, benchmarks, fixtures) is preserved.

The two-agent authorship flow applies to all production Go code. The file enumerates the carve-outs (documentation-only MRs, comment-only .go changes, bot-authored dependency updates), and the reviewer can require the full flow on any carved-out MR. No CI gate, no component list, no coverage threshold. Enforcement is the reviewer's call.

rapid is a documented test-only dependency. Go stdlib fuzzing has no dependency cost.

Test plan

• Doc renders on GitLab
• Internal link to docs/specs/ resolves
• Links to pgregory.net/rapid and Go fuzzing docs resolve

🤖 Generated with Claude Code