Merge branch 'main' into policy/scope-golangci-rule-to-vendored-copies

Stated unqualified, the rule forbade an agent from modifying
.golangci.yml anywhere, including the canonical copy in this repo --
the only place it can be fixed. Compliance and remediation were
mutually exclusive.

Scope the prohibition to the vendored copy in a consuming repo, which
is the property the rule exists to protect, and name the one legitimate
path for change: a PR against canonical here, merged only by the user.

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-09-05
+last_modified: 2026-08-19
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -270,10 +270,8 @@ style conventions are in separate documents:
   configuration changes are made to the canonical copy in the `prompts` repo and
   reach consuming repos by re-vendoring; an agent may open a PR against
   canonical, which only the user merges. The canonical golangci-lint version is
-  v2.13.2 (released 2026-08-27, built with Go 1.27; a linter built with an older
-  Go cannot check a module whose `go` directive is newer), installed
-  commit-pinned via
-  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@27774aaf853a4fd21f1dd5e69439459dc1b26e68`.
+  v2.12.2 (released 2026-05-06), installed commit-pinned via
+  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).