golangci: re-vendor the org config with gomodguard_v2 (closes #123)

The org .golangci.yml now uses gomodguard_v2 in place of the
deprecated gomodguard, which made every lint run print a deprecation
warning. The file is copied unchanged from sneak/prompts. It also turns
on depguard with the org test-support rule, which rejects
net/http/httptest except in test files and in files under a directory
whose name ends in test. This repo's previous copy had no deny entries
of its own, so there were none to carry forward.

Model: opus-5-5

TODO.md

@@ -21,9 +21,10 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 - 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
   replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
-  longer warns about it, and turns on `depguard` with the org rule that keeps
+  longer warns about it, and turns on `depguard` with the org `test-support`
-  `net/http/httptest` out of files that are not tests. This repo had no `deny`
+  rule, which rejects `net/http/httptest` except in test files and in files
-  entries of its own to carry forward (closes #123).
+  under a directory whose name ends in `test`. This repo had no `deny` entries
+  of its own to carry forward (closes #123).
 - 2026-09-29: nothing stands in for DNS any more. Watcher tests that look
   something up in DNS use the real resolver against live DNS servers and test
   record and nameserver changes by preparing the saved state a check starts