- Fix golangci-lint import path to v2/cmd/golangci-lint - Pin to v2.8.0 commit SHA (e2e40021c9007020676c93680a36e3ab06c6cd33) - Use CGO_ENABLED=0 for golangci-lint install - Remove unused //nolint:gosec directives flagged by nolintlint
Replace @latest with @v2.1.6 to comply with hash-pinning policy defined in REPO_POLICIES.md.
Multi-stage build: golang:1.24-alpine builder, alpine:3.21 runtime. Verified locally: all fx modules instantiate, migrations run, healthcheck responds at /.well-known/healthcheck.json.