Verify .golangci.yml against the linter schema in make lint

golangci-lint ignores keys it does not know and silently runs with
defaults, which is how the v1-era settings went unapplied. make lint now
runs golangci-lint config verify before golangci-lint run, in both the
Docker and the in-image paths.

Makefile

@@ -47,6 +47,11 @@ test:
 # docker) the image's own golangci-lint binary is used. The host module
 # cache is shared read-only; the linter and build caches live in named
 # volumes so repeated runs are fast.
+#
+# .golangci.yml is verified against the linter's schema first: golangci-lint
+# otherwise ignores keys it does not know and silently runs with defaults.
+LINT_COMMAND := golangci-lint config verify && golangci-lint run ./...
+
 lint:
 	@if command -v docker >/dev/null 2>&1; then \
 		docker run --rm \
@@ -54,9 +59,9 @@ lint:
 			-v "$$(go env GOMODCACHE)":/go/pkg/mod:ro \
 			-v sutil-golangci-lint-cache:/root/.cache/golangci-lint \
 			-v sutil-go-build-cache:/root/.cache/go-build \
-			-w /src $(GOLANGCI_LINT_IMAGE) golangci-lint run ./...; \
+			-w /src $(GOLANGCI_LINT_IMAGE) sh -c '$(LINT_COMMAND)'; \
 	else \
-		golangci-lint run ./...; \
+		$(LINT_COMMAND); \
 	fi
 
 # Format everything (writes files).