Disable canonicalheader in the canonical .golangci.yml (closes #105)

In golangci-lint v2.14.0, `canonicalheader` misses findings at random in a package that also calls `ResponseWriter.Header()`: a scratch module with one known finding, linted repeatedly with the pinned image and this config, passed with no issues on some runs. The same commit can then fail lint on one run and pass on the next, so the linter is disabled until a pinned golangci-lint release fixes it.

Model: opus-5-5

.golangci.yml

@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
+  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
+  package that also calls `ResponseWriter.Header()`, so the same tree can fail
+  lint on one run and pass on the next. It comes back once a pinned
+  golangci-lint release fixes it.
 - 2026-10-05: `script/cibuild`, `script/docker`, `script/lint` and `script/test`
   now assign the image tag from `script/projectname` on its own line before the
   `docker build` (issue 101), so `set -e` stops the script where