806b73c5c2
The go job and the macOS build matrix lacked the codec dev libraries that release.yml installs, so 'go vet' and 'go test' failed to compile the CGO codec packages (xlab/vorbis-go, go-librespot/flac) pulled in transitively via the Spotify provider. make ...vet... failed before it ever reached the security target, so govulncheck never ran in CI.