Update the canonical .golangci.yml for golangci-lint v2.15.0 (closes #142)

Moves the pin to v2.15.0 and enables canonicalheader again, because that
release fixes the random misses behind
#105.

The depguard exemption reached every directory below one ending in test,
and a whole checkout under such a directory. It now covers only the files
directly inside. gomodguard_v2 also blocks github.com/go-redis/redis/v9,
whose pre-releases can still be imported.

Three comments are corrected. A new comment says the file has no
formatters section, so golangci-lint run checks no formatting.

Model: opus-5-5

.golangci.yml

@@ -4,8 +4,8 @@ version: "2"
 # linters.settings, not top-level linters-settings) so that the
 # thresholds below are actually applied by golangci-lint >= v2.
 #
-# This file has no formatters section, so golangci-lint run does not run
+# This file has no formatters section, so golangci-lint run checks no
-# gofmt. A repository's script/fmt-check runs it, on the host.
+# formatting. A repository's script/fmt-check checks it, on the host.
 
 run:
   timeout: 5m
@@ -44,9 +44,7 @@ linters:
       # itself must never have, so a file that is not a test must not import
       # one. Test files, and the files inside a package whose directory name
       # ends in `test`, are where that code belongs, and are exempt. A package
-      # in a subdirectory of that directory is not exempt. `${base-path}` is
+      # in a subdirectory of that directory is not exempt.
-      # the directory holding this file, so the name of the directory a
-      # repository is cloned into does not count.
       #
       # The deny list below is the one part of this file a repository is
       # expected to extend, and the only part it may. depguard matches an
@@ -61,7 +59,7 @@ linters:
           files:
             - "$all"
             - "!$test"
-            - "!${base-path}**/*test/*"
+            - "!**/*test/*"
           deny:
             - pkg: net/http/httptest
               desc: >-
@@ -118,4 +116,3 @@ linters:
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-  uniq-by-line: false

TODO.md

@@ -29,19 +29,15 @@ fmt-check, and commit.
       misses behind issue 105.
     - The `depguard` exemption covers only the files directly inside a directory
       whose name ends in `test`. It used to reach every directory below that one
-      too. The name of the directory a repository is cloned into no longer
+      too.
-      counts.
     - `gomodguard_v2` also blocks `github.com/go-redis/redis/v9`, whose
       pre-releases can still be imported under that path.
-    - `uniq-by-line` is now `false`, so a line that trips two linters reports
+    - Three comments now say what is true: `exhaustruct` is listed as
-      both findings.
+      deprecated, the test double is named `github.com/go-redis/redismock/v9`,
-    - Three comments are corrected:
+      and the claim that every blocked module is in the Go package defaults is
-        - `exhaustruct` is listed as deprecated.
-        - The test double is named `github.com/go-redis/redismock/v9`.
-        - The claim that every blocked module is in the Go package defaults is
       gone.
     - A comment says the file has no `formatters` section, so
-      `golangci-lint run` does not run `gofmt`.
+      `golangci-lint run` checks no formatting.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
   (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
   https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API