golangci: sync canonical config with golangci-lint migrate output for v2.12.2

Replace the hand-migrated v2 config with the exact output of
golangci-lint migrate under v2.12.2, applied and verified on
dnswatcher (sha256 8804ff50ebba0e8b4129a03600137040421e43aef9b4054a626abfd13767b28b):

- disable deprecated gomodguard (gomodguard_v2 stays enabled via
  default: all; identical behavior, resolves the deprecation warning)
- add linters.exclusions and formatters.exclusions (generated: lax,
  default path excludes) replicating v1 defaults
- add explicit formatters block (gofmt, gofumpt, goimports); gci is
  intentionally not enabled because its two-group import ordering
  conflicts with the org's stdlib/third-party/local script/fmt style
- drop the explanatory header comment so the file is byte-identical
  with the verified copy consuming repos fetch

Update the TODO.md Completed Steps entry to match.

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -16,6 +12,7 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:
@@ -28,7 +25,25 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
+
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

TODO.md

@@ -22,8 +22,10 @@ fmt-check, and commit.
 # Completed Steps
 
 - 2026-08-07: Migrated the canonical `.golangci.yml` to the golangci-lint v2
-  config layout (settings under `linters.settings`, dropped
-  `exclude-use-default`).
+  schema via `golangci-lint migrate` under v2.12.2 (settings under
+  `linters.settings`, explicit `exclusions` and `formatters` blocks,
+  `gomodguard` disabled in favor of `gomodguard_v2`; `gci` intentionally not
+  enabled).
 - 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
   styleguide.
 - 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test