Disable canonicalheader in the canonical .golangci.yml (closes #105)

In golangci-lint v2.14.0, `canonicalheader` misses findings at random in a package that also calls `ResponseWriter.Header()`: a scratch module with one known finding, linted repeatedly with the pinned image and this config, passed with no issues on some runs. The same commit can then fail lint on one run and pass on the next, so the linter is disabled until a pinned golangci-lint release fixes it.

Model: opus-5-5

.golangci.yml

@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88

TODO.md

@@ -21,6 +21,11 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
+  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
+  package that also calls `ResponseWriter.Header()`, so the same tree can fail
+  lint on one run and pass on the next. It comes back once a pinned
+  golangci-lint release fixes it.
 - 2026-10-06: The canonical `.gitignore` and `.editorconfig` now each end with a
   comment saying the repository's own entries go below it and a re-vendor keeps
   them (issue 103, which took in issue 104), as `.dockerignore`'s header already