Canonical lives at infra ci-templates/golangci.yml, distributed by the infra#309 pattern: byte-identical copies, checksum drift gate in infra. Do not edit this file here -- edit the canonical and run `task ci:sync`. Verified locally before pushing, not pushed-and-hoped: golangci-lint v2.11.4 against a Go 1.26.1 toolchain (matching CI) reports 0 issues here. Also applies gofumpt, which this config enables and the golangci-lint v2 default set does not check at all. That gap is why the drift was invisible: earlier passes ran gofmt, which is weaker. Mechanical, deterministic, build+vet verified.