Update the canonical .golangci.yml for golangci-lint v2.15.0 (closes #142)

Moves the pin to v2.15.0 and enables canonicalheader again, because that
release fixes the random misses behind
#105.

The depguard exemption reached every directory below one ending in test,
and a whole checkout under such a directory. It now covers only the files
directly inside. gomodguard_v2 also blocks github.com/go-redis/redis/v9,
whose pre-releases can still be imported.

Three comments are corrected. A new comment says the file has no
formatters section, so golangci-lint run checks no formatting.

Model: opus-5-5

TODO.md

@@ -21,6 +21,23 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-03: The canonical golangci-lint is now v2.15.0, still built with
+  go1.27.0, so the `go` directive rule is unchanged (issue 142). Repositories
+  pick this up on their next re-vendor. Each item in the canonical
+  `.golangci.yml` was tried on a scratch module. These changed:
+    - `canonicalheader` is enabled again, because v2.15.0 fixes the random
+      misses behind issue 105.
+    - The `depguard` exemption covers only the files directly inside a directory
+      whose name ends in `test`. It used to reach every directory below that one
+      too.
+    - `gomodguard_v2` also blocks `github.com/go-redis/redis/v9`, whose
+      pre-releases can still be imported under that path.
+    - Three comments now say what is true: `exhaustruct` is listed as
+      deprecated, the test double is named `github.com/go-redis/redismock/v9`,
+      and the claim that every blocked module is in the Go package defaults is
+      gone.
+    - A comment says the file has no `formatters` section, so
+      `golangci-lint run` checks no formatting.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
   (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
   https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API