chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

Canonical lives at infra ci-templates/golangci.yml, distributed by the
infra#309 pattern: byte-identical copies, checksum drift gate in infra. Do
not edit this file here -- edit the canonical and run `task ci:sync`.

Verified locally before pushing, not pushed-and-hoped: golangci-lint v2.11.4
against a Go 1.26.1 toolchain (matching CI) reports 0 issues here.

Also applies gofumpt, which this config enables and the golangci-lint v2
default set does not check at all. That gap is why the drift was invisible:
earlier passes ran gofmt, which is weaker. Mechanical, deterministic,
build+vet verified.

internal/tools/file_write_branch_test.go

@@ -16,10 +16,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const branchCheckExistsResp = `{"name":"feat/x","commit":{"id":"abc","url":"http://example.com"}}`
-const createBranchResp = `{"name":"feat/new","commit":{"id":"abc","url":"http://example.com"}}`
-const upsertFileResp = `{"content":{"path":"doc.md","sha":"filsha","html_url":"http://example.com/doc.md"},"commit":{"sha":"cmt1","html_url":"http://example.com/commit/cmt1"}}`
-const getRepoResp = `{"name":"myrepo","full_name":"owner/myrepo","default_branch":"main"}`
+const (
+	branchCheckExistsResp = `{"name":"feat/x","commit":{"id":"abc","url":"http://example.com"}}`
+	createBranchResp      = `{"name":"feat/new","commit":{"id":"abc","url":"http://example.com"}}`
+	upsertFileResp        = `{"content":{"path":"doc.md","sha":"filsha","html_url":"http://example.com/doc.md"},"commit":{"sha":"cmt1","html_url":"http://example.com/commit/cmt1"}}`
+	getRepoResp           = `{"name":"myrepo","full_name":"owner/myrepo","default_branch":"main"}`
+)
 
 func TestFileWriteBranchCreatesBranchAndFile(t *testing.T) {
 	mux := http.NewServeMux()