✨ Add buf + goose, fix PATH order, rewrite README ✨

Add buf (modern protobuf toolchain) and goose (Go-native DB migration
runner) to complete the Go dev toolchain. Fix PATH order so baked image
tools in /usr/local/bin always take precedence over anything installed
at runtime into $GOPATH/bin. Full README rewrite following canonical
section order.
- Dockerfile: insert /usr/local/bin between /usr/local/go/bin and
/usr/local/share/go/bin in both build and final stage ENV PATH
- rootfs/etc/profile.d/go.sh: same PATH fix; explicit /usr/local/bin
guard added; $GOPATH/bin appended last
- rootfs/root/docker/setup/05-custom.sh: add buf@latest and
goose/v3@latest installs with descriptive comments
- README.md: full rewrite — H1 title, canonical section order (Pull,
Docker, Tools table, Env vars, PATH order, Persistence, Cross-compile,
Development, License); accurate tool list matching actual image content

Dockerfile
README.md
rootfs/etc/profile.d/go.sh
rootfs/root/docker/setup/05-custom.sh

rootfs/etc/profile.d/go.sh

@@ -14,12 +14,19 @@ export GOCACHE="${GOCACHE:-${GOPATH}/cache}"
 export CGO_ENABLED="${CGO_ENABLED:-0}"
 export GOTOOLCHAIN="${GOTOOLCHAIN:-auto}"
 
+# Go distribution bin first, then baked tools, then GOPATH/bin last so a
+# volume-mounted $GOPATH/bin never shadows baked image tools.
 case ":${PATH}:" in
   *":/usr/local/go/bin:"*) ;;
   *) export PATH="/usr/local/go/bin:${PATH}" ;;
 esac
 
 case ":${PATH}:" in
-  *":${GOPATH}/bin:"*) ;;
-  *) export PATH="${GOPATH}/bin:${PATH}" ;;
+  *":/usr/local/bin:"*) ;;
+  *) export PATH="/usr/local/bin:${PATH}" ;;
+esac
+
+case ":${PATH}:" in
+  *":${GOPATH}/bin:"*) ;;
+  *) export PATH="${PATH}:${GOPATH}/bin" ;;
 esac