Move the canonical golangci-lint to v2.15.0 and bring back canonicalheader

v2.15.0 (released 2026-10-16, built with go1.27.0 like v2.14.0) bundles
canonicalheader with its upstream fix for non-deterministic results, the
defect behind issue 105. Linted 20 times each on a scratch package with
two planted findings beside a ResponseWriter.Header() call, v2.14.0
reported them on 8 runs and nothing on 12; v2.15.0 reported them on all
20. REPO_POLICIES.md names the new digest; .golangci.yml no longer
disables canonicalheader and is otherwise unchanged, since it verifies
against v2.15.0 as it was and default: all switches on no new linter.

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-27
+last_modified: 2026-11-01
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -658,10 +658,10 @@ style conventions are in separate documents:
   `test-support` depguard rule, where a repo names its own test-support packages
   by full import path. A repo adds entries there and changes nothing else, and a
   re-vendor carries its entries forward. The canonical golangci-lint version is
-  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  v2.15.0 (released 2026-10-16), pinned as the digest of the lint phase's base
   image
-  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
-  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  (`golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481`,
+  which reports `2.15.0 built with go1.27.0 from 25c5369a`). A module's `go`
   directive must not name a newer Go minor version than the one golangci-lint
   was built with, or golangci-lint refuses to lint it: this release lints
   `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo