Set the lint digest and .golangci.yml together; state the Go version rule

The canonical .golangci.yml now names exhaustruct_v5, which v2.12.2
rejects, so a repo that re-vendors the file on the old digest gets a
lint phase that fails before checking any code. REPO_POLICIES now says
a repo sets the lint phase digest and re-vendors .golangci.yml in one
commit, whichever prompted the change, and both repo checklists point
to that rule. It also replaces "a new Go version needs a golangci-lint
built with it" with the rule golangci-lint applies: the go directive
must not name a newer Go minor version than the one it was built with.

Model: opus-5-5

.gitignore

@@ -20,26 +20,8 @@ Thumbs.db
 # Node
 node_modules/
 
-# Secrets. Unanchored like every entry above, so each matches at every
-# depth. Matching is case-sensitive on Linux, so names use character
-# ranges rather than a lowercase form that misses `Server.Key`.
-
-# Environment files. `*.env` covers bare `.env` and the `prod.env`
-# convention. Only the templates `example.env` and `sample.env` are
-# re-included below. A repository that commits any other template adds
-# its own negation after these lines, for example `!.env.example`.
-*.[eE][nN][vV]
-.[eE][nN][vV].*
-.[eE][nN][vV][rR][cC]
-!example.env
-!sample.env
-
-# Private keys and the bundles carrying them.
-*.[pP][eE][mM]
-*.[kK][eE][yY]
-*.[pP]12
-*.[pP][fF][xX]
-[iI][dD]_[rR][sS][aA]
-[iI][dD]_[dD][sS][aA]
-[iI][dD]_[eE][cC][dD][sS][aA]
-[iI][dD]_[eE][dD]25519
+# Environment / secrets
+.env
+.env.*
+*.pem
+*.key

TODO.md

@@ -28,11 +28,6 @@ fmt-check, and commit.
   `.golangci.yml` now disables `exhaustruct_v5` beside `exhaustruct`. v2.12.2
   rejects that file, so `REPO_POLICIES.md` and both repo checklists now say a
   repo sets the lint phase digest and re-vendors `.golangci.yml` in one commit.
-- 2026-10-03: Brought the canonical `.gitignore` level with `.dockerignore` on
-  secrets (issue 38): it now also ignores `prod.env`-style `*.env` files,
-  `.envrc`, `*.p12`, `*.pfx` and the extensionless SSH private keys, written to
-  `.gitignore`'s own rules (no `**/` prefix) and case-folded with character
-  ranges. `example.env` and `sample.env` stay trackable through negations.
 - 2026-10-02: The image version now comes from git inside the build (issues 69
   and 71), superseding the 2026-09-08 entry that excluded `.git`. The canonical
   `.dockerignore` sends `.git` but keeps out `.git/config`, which can hold a