golangci: re-vendor the org config with gomodguard_v2 (closes #123)

The org .golangci.yml now uses gomodguard_v2 in place of the
deprecated gomodguard, which made every lint run print a deprecation
warning. The file is copied unchanged from sneak/prompts. It also turns
on depguard with the org rule that keeps net/http/httptest out of files
that are not tests. This repo's previous copy had no deny entries of its
own, so there were none to carry forward.

Model: opus-5-5

TODO.md

@@ -21,10 +21,9 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 - 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
   replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
-  longer warns about it, and turns on `depguard` with the org `test-support`
-  rule, which rejects `net/http/httptest` except in test files and in files
-  under a directory whose name ends in `test`. This repo had no `deny` entries
-  of its own to carry forward (closes #123).
+  longer warns about it, and turns on `depguard` with the org rule that keeps
+  `net/http/httptest` out of files that are not tests. This repo had no `deny`
+  entries of its own to carry forward (closes #123).
 - 2026-09-29: nothing stands in for DNS any more. Watcher tests that look
   something up in DNS use the real resolver against live DNS servers and test
   record and nameserver changes by preparing the saved state a check starts