config: migrate gomodguard to gomodguard_v2 in canonical .golangci.yml

golangci-lint v2.12.0 deprecated `gomodguard` in favour of `gomodguard_v2`.
Because the canonical config uses `default: all`, the deprecated linter is
auto-enabled and every lint run in every consuming Go repo emits a
deprecation warning.

`gomodguard` and `gomodguard_v2` are two independently registered linters
in v2.12.2, so `gomodguard_v2` is already enabled by `default: all`; only
the deprecated one needs disabling. This mirrors the existing `wsl` entry,
which was disabled for the same reason when `wsl_v5` superseded it.

No settings migration was required: the canonical config configures no
gomodguard settings at all.

Refs: #25

.golangci.yml

@@ -16,6 +16,7 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:

prompts/EXISTING_REPO_CHECKLIST.md

@@ -59,9 +59,7 @@ with your task.
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
 - [ ] `make check` does not modify any files in the repo
-- [ ] `make test` has a 90-second timeout and completes within the 60-second
-      hard cap (over 20 seconds is green but must be filed as an improvement
-      bug)
+- [ ] `make test` has a 30-second timeout
 - [ ] `make test` runs real tests, not a no-op (at minimum, import/compile
       check)
 - [ ] `make check` passes on current branch

prompts/NEW_REPO_CHECKLIST.md

@@ -80,8 +80,8 @@ are thin shims calling them. Model scripts:
       installs
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` — runs real tests, not a no-op (90-second
-      timeout, 60-second hard cap on wall time)
+- [ ] `script/test` / `make test` — runs real tests, not a no-op (30-second
+      timeout)
 - [ ] `script/lint` / `make lint` — runs linter
 - [ ] `script/fmt` / `make fmt` — formats code (writes)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only)

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-20
+last_modified: 2026-08-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -69,15 +69,8 @@ style conventions are in separate documents:
   outputs the project's name. Scripts that need the name call
   `script/projectname` — e.g. `script/docker` assembles its image tag from it —
   so those scripts stay byte-identical across all repos. Repo-type-specific
-  verifications (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/check`, which is the gate the other entrypoints funnel through: it
-  runs in the Dockerfile build step and therefore in CI, and `script/precommit`
-  inherits it by calling `script/check`. In `script/precommit` alone such a
-  check binds only the contributors who installed the hook, and the hook file
-  itself stays a shim that carries no checks of its own. Anything added to
-  `script/check` must be read-only, since `make check` must not modify files, so
-  use a verify or diff mode (`go mod tidy -diff`) rather than a command that
-  rewrites the tree. Model scripts are at
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/precommit`, not in the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -196,13 +189,8 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 60 seconds. That is the hard cap, and a
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
-  sits above the hard cap so that it catches a genuinely hung test rather than a
-  merely slow one.
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+  Makefile.
 
 - **`make test` should use the conditional verbose rerun pattern.** Run tests
   without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
@@ -221,9 +209,9 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 90s -race -cover ./... || \
+    	@go test -timeout 30s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 30s -race -v ./...; exit 1; }
     ```
 
     Python example: