test(gozstd-purego): expand shim coverage (interop, concurrency, edges)

Add to the pure-Go zstd shim's suite: reverse interop (shim output
decoded by the libzstd `zstd` CLI, plain and with a dictionary); the
dst-append contract for all four Compress/Decompress[Dict] funcs (dolt
passes non-empty buffers); edge cases (empty, one-byte, incompressible
random, 4 MiB random, large text); race-clean concurrency over the shared
plain coders and a shared DDict; and error paths (garbage input errors,
empty input is a documented benign no-op, wrong-dictionary decode errors
rather than returning wrong bytes). All pass under -race.

build: pure-Go (CGO_ENABLED=0) build via a klauspost-backed gozstd shim

dolthub/dolt/go pulls in two hard cgo dependencies — go-icu-regex (SQL
REGEXP) and gozstd (NBS zstd compression) — which forced a C toolchain +
ICU headers on every build. Both are now avoided so the default build is
pure Go and statically linkable:

- ICU: build with `-tags gms_pure_go`, selecting go-mysql-server's stdlib
  regexp fallback. Safe because this service never runs the SQL engine
  (it serves bare NBS stores and browses read-only), so it never
  evaluates SQL REGEXP.
- zstd: `replace github.com/dolthub/gozstd => ./third_party/gozstd-purego`,
  a pure-Go drop-in over klauspost/compress/zstd (already in the graph).
  It reproduces the nine gozstd symbols dolt references. dolt is
  unmodified.

dolt uses gozstd only in its NBS archive subsystem; this binary hits only
the decompress side at runtime (archive dictionary TRAINING is gc/
archive-writer code we never run — the shim implements it over klauspost
but panics on the trainer errors that only that off-path use could
trigger). zstd frames and dictionaries are standard-format, so
libzstd-authored archives decode correctly; the shim's tests prove this
by decoding plain and dictionary-compressed frames produced by the zstd
CLI (libzstd).

The Makefile now defaults to CGO_ENABLED=0 + -tags gms_pure_go (override
with `make CGO_ENABLED=1 GO_TAGS=` for the cgo variant). Verified:
CGO_ENABLED=0 build of ./..., all unit tests, the real-dolt-CLI
integration + spike suites, and the shim's libzstd-interop tests, all
green with no cgo.