Move the canonical golangci-lint to v2.15.0 and bring back canonicalheader

v2.15.0 (released 2026-10-16, built with go1.27.0 like v2.14.0) bundles
canonicalheader with its upstream fix for non-deterministic results, the
defect behind issue 105. Linted 20 times each on a scratch package with
two planted findings beside a ResponseWriter.Header() call, v2.14.0
reported them on 8 runs and nothing on 12; v2.15.0 reported them on all
20. REPO_POLICIES.md names the new digest; .golangci.yml no longer
disables canonicalheader and is otherwise unchanged, since it verifies
against v2.15.0 as it was and default: all switches on no new linter.

TODO.md

@@ -21,6 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-01: Moved the canonical golangci-lint to v2.15.0 (released
+  2026-10-16), still built with go1.27.0, so the `go` directive rule is
+  unchanged. The canonical `.golangci.yml` passes `golangci-lint config verify`
+  on v2.15.0, and `default: all` switches on no new linter. `canonicalheader` is
+  enabled again (issue 105): v2.15.0 carries the upstream commit "fix:
+  non-deterministic results", and on a scratch package with two planted findings
+  beside a `ResponseWriter.Header()` call, linted 20 times with each pinned
+  image, v2.14.0 reported them on 8 runs and nothing on 12, while v2.15.0
+  reported them on all 20.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
   (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
   https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API