Allow homoicon's local copy of sobek in the canonical .golangci.yml (closes #134)

sneak decided that homoicon keeps a local copy of sobek, its JavaScript
engine, and fixes it in its own tree
(sneak/homoicon#1759 (comment)).
homoicon's go.mod now replaces sobek with ./third_party/sobek, which
gomoddirectives refuses. The canonical .golangci.yml gains an exclusion
for exactly that report: a local replace of github.com/grafana/sobek in
a repository's root go.mod. Every other local replace is still refused.
It is an exclusion rather than a replace-allow-list entry because
gomoddirectives does not check that list for a replace that points at a
local path. TODO.md records the change.

Model: opus-5-5

TODO.md

@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
+  `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
+  homoicon, which keeps a local copy of sobek on sneak's decision in
+  https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261. Every
+  other local `replace` is still refused. It is an exclusion rather than a
+  `replace-allow-list` entry because gomoddirectives does not check that list
+  for a `replace` that points at a local path. homoicon picks this up on its
+  next re-vendor.
 - 2026-10-18: Check builds may now also keep Go's downloaded modules,
   golangci-lint's cache and the layers that install system packages (issue 130),
   on sneak's ruling there. In each stage of the canonical Go `Dockerfile`, the