refactor(starters): render the starter workspaces from Go instead of shell

[viniciusdc]

Follows up @marcelovilla's review comment on #594: render the starters from a small Go command rather than a bash script, so the fragile parts are unit-testable.

What

scripts/gen-starters.sh becomes cmd/starters. Output is byte-identical - I diffed the two generators' full output trees before deleting the script.

The difference is what can go wrong, and when it is caught.

Why it is less fragile, concretely

The script located values by line prefix, indentation included:

'    email: '
'    url: '
'    path: '

That cannot tell the GitOps path: from any other four-space path: key, which is why the script grew a guard requiring each prefix to match exactly one line - and a restructure of examples/ only surfaced once CI had built nic and rendered a starter.

Resolving each field as a YAML path removes the ambiguity instead of defending against it:

"$.repository.existing.path"

A path either resolves or it fails naming itself. Three pieces of machinery go with it: the exactly-one-match guard, the sed dance that reattached a trailing comment to a replaced line, and the hardcoded indentation.

Comments and blank lines still survive

That was the one argument for staying in shell, and @marcelovilla checked it before raising this. The edit is applied to the source text rather than by marshalling the parsed document back out: each value's token gives the line and column where the value starts, so rewriting from that column leaves the rest of the line - trailing comment included - untouched.

    path: CHANGEME  # Optional subdirectory within the repository

goccy/go-yaml is already the parser on both sides of this - #603 made it the config parser, and #583's placeholder gate walks its AST - so this is the same library the validation half already uses, not a new dependency.

Block scalars are rejected explicitly: their token is the |/> indicator rather than the body, so a newline check never fires and an in-place edit would leave the following lines orphaned. That one cost me a red test before I understood it.

Tests

The point of the move. TestDeclaredFieldsResolveAgainstTheRealExamples resolves every declared field against the actual examples/*.yaml at go test time, so a renamed key fails on a laptop instead of in CI. TestPlaceholderConfigTargetsTheRightKeyAmongSameNamedSiblings pins the exact case the line-prefix match got wrong. Plus comment/blank-line preservation, the unresolvable-path error, block-scalar rejection, and the template renderer including its leftover-token check.

Test plan

• go build ./..., go vet ./..., gofmt clean
• go test -short ./... passes
• Output is byte-identical to scripts/gen-starters.sh (diff -r over both trees, same -version)
• The validate-starters assertions pass against the Go-rendered starters: rejected unedited, rejection comes from the placeholder gate, and it names exactly the expected field paths for both providers
• make starters renders both providers; no leftover __TOKEN__; both pixi.toml parse

[marcelovilla]

Thanks for addressing all the comments @viniciusdc! Approving now

This comment was actually meant for #594

Dismissing my own review as it was meant for another PR

[marcelovilla]

Thanks for this PR @viniciusdc! As I mentioned before, I think this approach is more robust. Tested locally and works as expected.