docs(agents): stop asserting a go shim that is not present on every host

[atbrace]

Refs gcy-2o1, gcy-lcs, gcy-ajv.

The defect

AGENTS.md → Build Cache Conventions told agents to "just run go build / make — do NOT set GOCACHE yourself", on the stated grounds that "the host go shim already routes the default GOCACHE to a shared on-disk cache (~/.cache/go-build) and pins compile/link temp to disk (GOTMPDIR=/var/tmp/gotmp)", concluding a warm shared cache "is never corrupted by a normal build."

Every factual clause is false on an unshimmed developer machine. Verified on the macOS host this repo is developed on:

claim	reality
a host go shim	which -a go → one entry, a plain Homebrew symlink to ../Cellar/go/1.26.5/bin/go
GOCACHE=~/.cache/go-build	/Users/<u>/Library/Caches/go-build; ~/.cache/go-build absent
GOTMPDIR=/var/tmp/gotmp	"" — empty; /var/tmp/gotmp absent, linker scratch follows $TMPDIR unpinned
"/tmp is a size-capped RAM-backed tmpfs (61G)" (same section)	APFS disk

The shim is a fleet-provisioning artifact; nothing in this repo installs it. The section now says so up front and gives the two commands that settle it, instead of stating the shimmed configuration as universal fact.

The costly half

"Never corrupted by a normal build" is true only for a build with the project's normal flags — and diagnosing a broken build is exactly when an agent varies CGO_CPPFLAGS, CGO_CXXFLAGS, or tags.

Following this instruction, two agents nine hours apart wrote CGO_CXXFLAGS-only go-icu-regex archives into the shared cache — e9a0aecd748d @ 03:52:20Z and f2cb903213fb @ 13:06:44Z, both 2026-08-01 (gcy-lcs). Each needed manual nm verification and surgical deletion, because nothing detects a poisoned entry: the resulting failure names the flags, never the cache.

So this PR adds the rule that was missing — diagnostic and flag-varying builds get a throwaway GOCACHE, via the isolated-build recipe already documented a few lines below.

Unchanged in substance

The hard ban on go clean -cache, the /tmp guidance, and the isolated-build recipe all stay. The /tmp paragraph is now scoped to fleet executors, where its tmpfs premise actually holds. The recipe's mktemp -d -p /var/tmp was checked for portability and does work on macOS.

make check-docs (go test ./test/docsync) passes via the pre-commit hook.

Follow-up, deliberately not in this PR

The gate list still reads "go vet ./... clean", and make vet is literally go vet ./... with no CGO configuration — TEST_ENV forwards CGO_CPPFLAGS but leaves it empty unless the caller set it. That is the shape that made the refinery's quality-gate fallback die on go-icu-regex. Confirming it costs a real compile on a host under an operational build hold, so it is filed on gcy-2o1 rather than guessed at here.