The canonical config is already in the v2 layout and now enables
depguard with the test-support rule and a gomodguard_v2 block list;
this copy is byte-identical to it plus exhaustruct_v5 in the disable
list, which is what the pending upstream change adds. REPO_POLICIES.md
is refreshed from 2026-07-06 to 2026-09-08.
Convert .golangci.yml to the v2 layout: linters-settings and
issues.exclude-use-default were rejected by the v2 schema, so the lll,
funlen, cyclop, and dupl settings were never applied. Disable
exhaustruct_v5 (the newer major version of the already-disabled
exhaustruct) and the deprecated gomodguard. Pin the golangci-lint image
at v2.15.0 in the Makefile and Dockerfile.