Update the canonical .golangci.yml for golangci-lint v2.15.0 (closes #142)

Moves the pin to v2.15.0 and enables canonicalheader again, because that
release fixes the random misses behind
#105.

The depguard exemption reached every directory below one ending in test,
and a whole checkout under such a directory. It now covers only the files
directly inside, and the directory a repository is cloned into does not
count. gomodguard_v2 also blocks github.com/go-redis/redis/v9, whose
pre-releases can still be imported.

uniq-by-line is now false, so a line that trips two linters reports both
findings.

Three comments are corrected. A new comment says the file has no
formatters section, so golangci-lint run does not run gofmt.

Model: opus-5-5

.golangci.yml

@@ -4,8 +4,8 @@ version: "2"
 # linters.settings, not top-level linters-settings) so that the
 # thresholds below are actually applied by golangci-lint >= v2.
 #
-# This file has no formatters section, so golangci-lint run checks no
-# formatting. A repository's script/fmt-check checks it, on the host.
+# This file has no formatters section, so golangci-lint run does not run
+# gofmt. A repository's script/fmt-check runs it, on the host.
 
 run:
   timeout: 5m
@@ -44,7 +44,9 @@ linters:
       # itself must never have, so a file that is not a test must not import
       # one. Test files, and the files inside a package whose directory name
       # ends in `test`, are where that code belongs, and are exempt. A package
-      # in a subdirectory of that directory is not exempt.
+      # in a subdirectory of that directory is not exempt. `${base-path}` is
+      # the directory holding this file, so the name of the directory a
+      # repository is cloned into does not count.
       #
       # The deny list below is the one part of this file a repository is
       # expected to extend, and the only part it may. depguard matches an
@@ -59,7 +61,7 @@ linters:
           files:
             - "$all"
             - "!$test"
-            - "!**/*test/*"
+            - "!${base-path}**/*test/*"
           deny:
             - pkg: net/http/httptest
               desc: >-
@@ -116,3 +118,4 @@ linters:
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
+  uniq-by-line: false

TODO.md

@@ -29,15 +29,19 @@ fmt-check, and commit.
       misses behind issue 105.
     - The `depguard` exemption covers only the files directly inside a directory
       whose name ends in `test`. It used to reach every directory below that one
-      too.
+      too. The name of the directory a repository is cloned into no longer
+      counts.
     - `gomodguard_v2` also blocks `github.com/go-redis/redis/v9`, whose
       pre-releases can still be imported under that path.
-    - Three comments now say what is true: `exhaustruct` is listed as
-      deprecated, the test double is named `github.com/go-redis/redismock/v9`,
-      and the claim that every blocked module is in the Go package defaults is
-      gone.
+    - `uniq-by-line` is now `false`, so a line that trips two linters reports
+      both findings.
+    - Three comments are corrected:
+        - `exhaustruct` is listed as deprecated.
+        - The test double is named `github.com/go-redis/redismock/v9`.
+        - The claim that every blocked module is in the Go package defaults is
+          gone.
     - A comment says the file has no `formatters` section, so
-      `golangci-lint run` checks no formatting.
+      `golangci-lint run` does not run `gofmt`.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
   (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
   https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API