ci: yaegi catalog-analyzer gate harness

Add tools/yaegi-check, a separate Go module (llmgw-yaegi-check,
never a dependency of the plugin module) that replicates the
Traefik Plugin Catalog analyzer (piceus)'s yaegiMiddlewareCheck:
copy the repo into a temp GOPATH, interp.New + i.Use(stdlib.Symbols),
import the plugin package, eval CreateConfig(), decode the plugin's
real .traefik.yml testData into it via a hand-rolled YAML-subset
parser plus a JSON round-trip, reflect-Call New from outside the
interpreter, then exercise the returned handler with two real HTTP
requests (authenticated GET /v1/models against the testData key, and
the same route unauthenticated). Pins github.com/traefik/yaegi to
v0.16.1, confirmed as Traefik v3.5.0's own vendored version by
downloading its go.mod.

Wire cd tools/yaegi-check && GOWORK=off go run . /Users/nvm/Documents/projects/private/traefik-llmgateway
yaegi-check: OK to run the harness from repo root.

The harness caught a real Yaegi v0.16.1 limitation: calling a struct
FIELD of variadic func type (e.g. modelRegistry.log
func(string, ...any)) with two or more variadic arguments crashes
Yaegi's CFG builder ('index out of range'). The identical call shape
through a method or interface method is unaffected — bisected with a
standalone yaegi repro to confirm the exact trigger before touching
plugin code. Fixed by pre-formatting with fmt.Sprintf at
modelRegistry's three affected call sites (registry.go) so the field
is always called with exactly one variadic argument; documented the
constraint on both modelRegistry.log and limiter.logf so it is not
reintroduced. Verified the gate itself is load-bearing by temporarily
renaming CreateConfig (harness failed non-zero) and restoring it
(harness passed again).

Also fixes two golangci-lint findings in the new harness module
(govet shadow, gosec G301 directory permissions).

limits.go

@@ -249,12 +249,19 @@ type limitViolation struct {
 // limiter enforces per-minute/day/month request, token, and cost limits
 // using fixed windows keyed by windowKey.
 type limiter struct {
-	store            counterStore                     // configured backend; nil means always use fallback (see newLimiter)
-	fallback         *memoryStore                     // in-process counter store, always available
-	nowFn            func() time.Time                 // injected for tests; defaults to time.Now
-	logf             func(format string, args ...any) // injectable store-error log; defaults to a no-op
-	lastLogAt        time.Time                        // guarded by logMu; last time a store error was logged
-	lastStoreFailure time.Time                        // guarded by logMu; zero means the store-down latch is not open (see storeLatched)
+	store    counterStore     // configured backend; nil means always use fallback (see newLimiter)
+	fallback *memoryStore     // in-process counter store, always available
+	nowFn    func() time.Time // injected for tests; defaults to time.Now
+	// logf is a bound method value (g.errorf), injectable for tests; defaults
+	// to a no-op. Its own call site (logStoreError) passes exactly one
+	// variadic argument — never extend that to two or more without first
+	// reading modelRegistry.log's doc comment in registry.go: a struct
+	// field of variadic func type crashes Yaegi v0.16.1's CFG builder past
+	// one variadic argument, even though the identical call through a
+	// method or interface method does not.
+	logf             func(format string, args ...any)
+	lastLogAt        time.Time // guarded by logMu; last time a store error was logged
+	lastStoreFailure time.Time // guarded by logMu; zero means the store-down latch is not open (see storeLatched)
 	logMu            sync.Mutex
 	failOpen         bool // store-error policy: true falls back to fallback, false refuses the request
 }