Verify .golangci.yml against the linter schema in make lint

golangci-lint ignores keys it does not know and silently runs with
defaults, which is how the v1-era settings went unapplied. make lint now
runs golangci-lint config verify before golangci-lint run, in both the
Docker and the in-image paths.

Makefile

@@ -47,6 +47,11 @@ test:
 # docker) the image's own golangci-lint binary is used. The host module
 # cache is shared read-only; the linter and build caches live in named
 # volumes so repeated runs are fast.
+#
+# .golangci.yml is verified against the linter's schema first: golangci-lint
+# otherwise ignores keys it does not know and silently runs with defaults.
+LINT_COMMAND := golangci-lint config verify && golangci-lint run ./...
+
 lint:
 	@if command -v docker >/dev/null 2>&1; then \
 		docker run --rm \
@@ -54,9 +59,9 @@ lint:
 			-v "$$(go env GOMODCACHE)":/go/pkg/mod:ro \
 			-v sutil-golangci-lint-cache:/root/.cache/golangci-lint \
 			-v sutil-go-build-cache:/root/.cache/go-build \
-			-w /src $(GOLANGCI_LINT_IMAGE) golangci-lint run ./...; \
+			-w /src $(GOLANGCI_LINT_IMAGE) sh -c '$(LINT_COMMAND)'; \
 	else \
-		golangci-lint run ./...; \
+		$(LINT_COMMAND); \
 	fi
 
 # Format everything (writes files).

README.md

@@ -224,11 +224,13 @@ Go, prettier for markdown), `make check` for all three, `make build`,
 install the pinned prettier.
 
 `make lint` runs golangci-lint inside the same hash-pinned Docker image the CI
-build uses, so local results match CI exactly. The `Dockerfile` splits
-`make check` across stages: a lint stage and a markdown-check stage fail fast in
-seconds, and the build stage, which runs the tests and compiles `sutil`, depends
-on both. The runtime image carries the binary and the source it was built from.
-Every external reference, from base images to the GitHub Action in
+build uses, so local results match CI exactly, and first verifies
+`.golangci.yml` against the linter's schema, because golangci-lint otherwise
+ignores keys it does not know and silently runs with defaults. The `Dockerfile`
+splits `make check` across stages: a lint stage and a markdown-check stage fail
+fast in seconds, and the build stage, which runs the tests and compiles `sutil`,
+depends on both. The runtime image carries the binary and the source it was
+built from. Every external reference, from base images to the GitHub Action in
 `.gitea/workflows/check.yml`, is pinned by content hash with a version and date
 comment. `.golangci.yml` is this repo's copy of the standard configuration, kept
 in the v2 layout with `exhaustruct_v5` and the deprecated `gomodguard` disabled.