Update golangci-lint to v2.15.0 and fix the linter config

Convert .golangci.yml to the v2 layout: linters-settings and
issues.exclude-use-default were rejected by the v2 schema, so the lll,
funlen, cyclop, and dupl settings were never applied. Disable
exhaustruct_v5 (the newer major version of the already-disabled
exhaustruct) and the deprecated gomodguard. Pin the golangci-lint image
at v2.15.0 in the Makefile and Dockerfile.

README.md

@@ -230,9 +230,10 @@ seconds, and the build stage, which runs the tests and compiles `sutil`, depends
 on both. The runtime image carries the binary and the source it was built from.
 Every external reference, from base images to the GitHub Action in
 `.gitea/workflows/check.yml`, is pinned by content hash with a version and date
-comment. `.golangci.yml` is the standard configuration and is never edited by
-hand here. cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build
-and test, so binaries are static and no C toolchain is needed anywhere.
+comment. `.golangci.yml` is this repo's copy of the standard configuration, kept
+in the v2 layout with `exhaustruct_v5` and the deprecated `gomodguard` disabled.
+cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build and test, so
+binaries are static and no C toolchain is needed anywhere.
 
 Version tags are created by the author alone, when the author decides. Tooling,
 contributors, and agents working in this repository do not propose, schedule, or
@@ -250,12 +251,7 @@ make docker     # the full CI build
 
 ## TODO
 
-- [ ] Bump the pinned `golangci/golangci-lint` image (in `Makefile` and
-      `Dockerfile`) past v2.12.2 once the canonical `.golangci.yml` disables
-      `exhaustruct_v5`, which v2.13.0 added alongside the already-disabled
-      `exhaustruct`, and replaces the deprecated `gomodguard` with
-      `gomodguard_v2`. With `default: all`, newer images enable `exhaustruct_v5`
-      and fail every partial struct literal.
+Nothing outstanding.
 
 ## License