Stated unqualified, the rule forbade an agent from modifying
.golangci.yml anywhere, including the canonical copy in this repo --
the only place it can be fixed. Compliance and remediation were
mutually exclusive.
Scope the prohibition to the vendored copy in a consuming repo, which
is the property the rule exists to protect, and name the one legitimate
path for change: a PR against canonical here, merged only by the user.
