Update golangci-lint to v2.15.0 and fix the linter config

Convert .golangci.yml to the v2 layout: linters-settings and
issues.exclude-use-default were rejected by the v2 schema, so the lll,
funlen, cyclop, and dupl settings were never applied. Disable
exhaustruct_v5 (the newer major version of the already-disabled
exhaustruct) and the deprecated gomodguard. Pin the golangci-lint image
at v2.15.0 in the Makefile and Dockerfile.

.golangci.yml

@@ -9,13 +9,14 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Same linter, newer major version (since v2.13.0)
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-
-linters-settings:
+  settings:
     lll:
       line-length: 88
     funlen:
@@ -26,7 +27,8 @@ linters-settings:
     dupl:
       threshold: 100
 
+# No default exclusions: v2 applies none unless linters.exclusions.presets
+# is set, which replaces v1's exclude-use-default: false.
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -9,10 +9,8 @@
 # BuildKit cannot finish the build unless every check passed.
 
 # Lint stage: fast feedback on Go formatting and lint issues
-# golangci/golangci-lint:v2.12.2, 2026-05-06
-# Pinned below v2.13.0 until the canonical .golangci.yml disables
-# exhaustruct_v5 (see the TODO in README.md). Keep in sync with Makefile.
-FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# golangci/golangci-lint:v2.15.0, 2026-10-16 (keep in sync with Makefile)
+FROM golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481 AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

Makefile

@@ -12,10 +12,8 @@ VERSION := $(shell git describe --always --dirty 2>/dev/null || echo dev)
 GOLDFLAGS := -X main.Version=$(VERSION)
 GO_DIRS := cmd internal pkg
 
-# golangci/golangci-lint:v2.12.2, 2026-05-06
-# Pinned below v2.13.0 until the canonical .golangci.yml disables
-# exhaustruct_v5 (see the TODO in README.md). Keep in sync with Dockerfile.
-GOLANGCI_LINT_IMAGE := golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
+# golangci/golangci-lint:v2.15.0, 2026-10-16 (keep in sync with Dockerfile)
+GOLANGCI_LINT_IMAGE := golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481
 
 # flags are repeated here (also in .prettierrc) so this Makefile works
 # standalone when copied as a template

README.md

@@ -230,9 +230,10 @@ seconds, and the build stage, which runs the tests and compiles `sutil`, depends
 on both. The runtime image carries the binary and the source it was built from.
 Every external reference, from base images to the GitHub Action in
 `.gitea/workflows/check.yml`, is pinned by content hash with a version and date
-comment. `.golangci.yml` is the standard configuration and is never edited by
-hand here. cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build
-and test, so binaries are static and no C toolchain is needed anywhere.
+comment. `.golangci.yml` is this repo's copy of the standard configuration, kept
+in the v2 layout with `exhaustruct_v5` and the deprecated `gomodguard` disabled.
+cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build and test, so
+binaries are static and no C toolchain is needed anywhere.
 
 Version tags are created by the author alone, when the author decides. Tooling,
 contributors, and agents working in this repository do not propose, schedule, or
@@ -250,12 +251,7 @@ make docker     # the full CI build
 
 ## TODO
 
-- [ ] Bump the pinned `golangci/golangci-lint` image (in `Makefile` and
-      `Dockerfile`) past v2.12.2 once the canonical `.golangci.yml` disables
-      `exhaustruct_v5`, which v2.13.0 added alongside the already-disabled
-      `exhaustruct`, and replaces the deprecated `gomodguard` with
-      `gomodguard_v2`. With `default: all`, newer images enable `exhaustruct_v5`
-      and fail every partial struct literal.
+Nothing outstanding.
 
 ## License