ci: lint, vet and test relay/ as its own module

[ndeloof]

What this PR does, in one sentence

relay/'s Go source now gets vetted, linted, and tested in CI — until now only its container image build was ever validated.

Context

relay/ (github.com/docker/compose-relay) is a separate go.mod, added alongside the network relay feature. Root go vet/golangci-lint/go test never covered it — the local pre-commit hook even carves it out explicitly, precisely because a separate module needs its own invocation. CI's relay-image-cross/relay-image-test only ever checked that the image builds and cross-compiles; the Go source itself had no quality gate.

What this PR brings

• relay-lint and relay-test bake targets, mirroring the root lint/test Dockerfile stages: a build-base downloading go.mod's dependencies (currently none), a lint stage on the same pinned golangci-lint version as the root, and a test stage running go vet then go test.
• relay-lint joins the validate bake group; both are new entries in the CI validate matrix job, alongside lint, validate-go-mod, etc.
• relay/.golangci.yml: its own config, since the lint stage's build context is ./relay only and can't see the root one. Same ruleset as root, minus what a dependency-free module doesn't need (the e2e build tag, testify/gotest.tools-specific depguard entries).
• 8 real findings turning lint on for the first time surfaced in relay/main.go/main_test.go — unchecked Close() errors, %v instead of %w on a wrapped error, a redundant embedded-field selector, and a log.Fatalf after a defer that would never run. Fixed here so the new job is green from the start rather than merged red.

🤖 Generated with Claude Code

[docker-agent]

Assessment: 🟢 APPROVE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!