GeezerVison

GenPyPkgSetup chdirs into the output directory, and neither command
changed back, so a caller running gopy in-process (as main_test.go does)
was left in the output directory, or in no directory at all once that
was removed: every later build then failed with

    getwd: no such file or directory

TestPkg builds _examples/simple with gopy pkg and runs its test.py.

gopy exe printed `go build -o py<pkg>` but ran `go build -mod=mod` alone:
the -o and -tags it appended went to an unused slice, so the executable
was named after the directory and built without the requested tags.  It
now runs the command it prints, adding Windows' .exe suffix.

The build that only writes <pkg>_go.h for the second build.py run was a
c-shared link of a .c file compiled against the placeholder header, which
macOS and Windows refuse when it calls functions (such as the static
_gopy_clear_go_tls) it can't link to yet.  It is now a c-archive, which
writes the header without linking, both in gopy exe and in the Makefile
it generates.

The BuildMode constants other than ModeGen were untyped strings; they
are now typed, and runBuild is passed bind.ModeBuild.

TestExe checks that gopy exe writes setup.py and the executable.

The generator keeps its state in package variables and gopy changes the
process's working directory, so main_test.go ran every gopy command
in-process and in sequence.  TestMain now builds the gopy binary once and
the tests run it as a separate process, which lets them call t.Parallel().

`make cover` collects coverage from those gopy processes too: the test
binaries and gopy write raw coverage data to covdata/, which is merged
into coverage.out.  codecov.yml counts Go's "partial" lines as hits, as
`go tool cover` does.

Also ignore Python bytecode caches, and remove the one that was committed
under _examples/funcs.

- Pin goimports to v0.29.0 instead of @latest, so the tool TestGofmt
  checks against doesn't change from one run to the next.
- Drop the apt-get step: none of the packages it installed are used.
- Disable Windows Defender real-time scanning, which slows every
  compile, link and pip install on windows-latest.
- Give the job a 20-minute timeout, rather than GitHub's 6h default.
- Cancel a pull request's previous run when it is pushed to again, and
  let the matrix fail fast.