Migrate canonical .golangci.yml to gomodguard_v2 with a block list (closes #25)

golangci-lint v2.12.0 deprecated gomodguard, and `linters.default: all`
enables it, so every lint run in every consuming Go repo prints a
deprecation warning. Disable the old name, which is what silences the
warning; name gomodguard_v2 in linters.enable so the settings block has
a visible owner; give it a blocked module list.

The list restates only decisions already recorded in the Go package
defaults: zerolog, the pre-fork go-redis/redis, sergi/go-diff and
hexops/gotextdiff. The pre-fork go-redis gets one exact entry per module
path (unversioned, /v7, /v8), because its later releases are separate
paths; a prefix match would be shorter but would also block
go-redis/redismock, the test double for the successor recommended here.
Recorded rejections that vendoring repos still require are deliberately
absent, so a re-vendor cannot redden a repo that has done nothing wrong.

Model: opus-5

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-08-31: Migrated the canonical `.golangci.yml` from the deprecated
+  `gomodguard` to `gomodguard_v2`: the old linter is disabled by name (which is
+  what silences the deprecation warning), the successor is named explicitly in
+  `linters.enable`, and it carries a `blocked` module list drawn only from
+  decisions already recorded in the Go package defaults.
 - 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema
   config already deployed byte-identical across the org's Go repos (settings
   under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually