fix(P1): remove plugin: from .coreci.yml jobs — invoke-only (REQ-184)

CoreCI's validate() rejects jobs with both plugin and invoke set
(mutually exclusive — pipeline.go:119). The previous commit used both
plugin: docker://golang:1.25.12 and invoke: on each job, causing:
  Error: load config: validate: job "gosec": plugin and invoke are
  mutually exclusive

Fix: remove all plugin: fields. Jobs run via the shell-isolated executor
which runs sh -c <invoke> directly. Go 1.25 is installed on the Gitea
Actions runner via actions/setup-go, so all Go commands work. Tool
installation via go install (gosec, govulncheck) and curl (gitleaks,
tea) works in the shell-isolated executor.

---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---

.coreci.yml

@@ -7,8 +7,8 @@ description: Orca — offline/CLI-first orchestration engine. Full release flow
 # CoreCI's Pipeline struct only recognizes `jobs:`, `services:`, and `env:`
 # top-level keys. Unknown keys (like the old `pipelines:`) are silently
 # dropped by yaml.Unmarshal, producing an empty Jobs map → zero jobs
-# execute. This file uses the native `jobs:`/`plugin:`/`invoke:`/`vars:`
-# format with a DAG via `needs:`.
+# execute. This file uses the native `jobs:`/`invoke:`/`vars:` format
+# with a DAG via `needs:`.
 #
 # DAG: go-vet → fan-out (verify-reqs, gosec, govulncheck, gitleaks) → build → test → release
 #
@@ -16,11 +16,12 @@ description: Orca — offline/CLI-first orchestration engine. Full release flow
 # `on: push: tags: ['v*']`, so every `coreci run` invocation is already
 # a release run — no tag-conditional rules needed here.
 #
-# Each job declares `plugin: docker://golang:1.25.12` for the container
-# path and `invoke:` for the shell command. If no container runtime is
-# available (podman/docker), CoreCI's shell-isolated executor runs the
-# `invoke:` command directly — the Gitea Actions runner has Go 1.25
-# installed via actions/setup-go, so Go commands work in both paths.
+# Each job uses `invoke:` only (no `plugin:`). CoreCI's validate()
+# rejects jobs with both `plugin` and `invoke` set (mutually exclusive).
+# Jobs run via the shell-isolated executor, which runs `sh -c <invoke>`
+# directly. The Gitea Actions runner has Go 1.25 installed via
+# actions/setup-go, so all Go commands work. Tool installation via
+# `go install` (gosec, govulncheck) and `curl` (gitleaks, tea) works.
 #
 # Security scans (REQ-014, REQ-027, REQ-039):
 #   - gosec        Static analysis for Go security smells
@@ -32,7 +33,6 @@ description: Orca — offline/CLI-first orchestration engine. Full release flow
 jobs:
   # ── validate ──────────────────────────────────────────────────────────
   go-vet:
-    plugin: docker://golang:1.25.12
     invoke: |
       go version
       gofmt -l .
@@ -40,19 +40,16 @@ jobs:
 
   verify-reqs:
     needs: [go-vet]
-    plugin: docker://golang:1.25.12
     invoke: "make verify-reqs"
 
   gosec:
     needs: [go-vet]
-    plugin: docker://golang:1.25.12
     invoke: |
       go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
       gosec -fmt text -quiet ./...
 
   govulncheck:
     needs: [go-vet]
-    plugin: docker://golang:1.25.12
     vars:
       GOFLAGS: "-mod=mod"
     invoke: |
@@ -61,7 +58,6 @@ jobs:
 
   gitleaks:
     needs: [go-vet]
-    plugin: docker://golang:1.25.12
     invoke: |
       curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64.tar.gz -o /tmp/gitleaks.tar.gz
       tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
@@ -76,7 +72,6 @@ jobs:
   # invoke: via sh -c at runtime.
   build:
     needs: [verify-reqs, gosec, govulncheck, gitleaks]
-    plugin: docker://golang:1.25.12
     invoke: |
       VERSION="${CI_COMMIT_BRANCH:-dev}"
       GIT_COMMIT="${CI_COMMIT_SHA:-unknown}"
@@ -92,7 +87,6 @@ jobs:
   # ── test (REQ-031: -race) ────────────────────────────────────────────
   test:
     needs: [build]
-    plugin: docker://golang:1.25.12
     invoke: |
       go test -race -coverprofile=coverage.out ./...
       go tool cover -func=coverage.out | tail -1
@@ -106,7 +100,6 @@ jobs:
   # (os.Getenv fallback in run.go:146-153) and forwarded by PassThroughEnv.
   release:
     needs: [test]
-    plugin: docker://golang:1.25.12
     vars:
       GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
     invoke: |