chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

Canonical lives at infra ci-templates/golangci.yml, distributed by the
infra#309 pattern: byte-identical copies, checksum drift gate in infra. Do
not edit this file here -- edit the canonical and run `task ci:sync`.

Verified locally before pushing, not pushed-and-hoped: golangci-lint v2.11.4
against a Go 1.26.1 toolchain (matching CI) reports 0 issues here.

Also applies gofumpt, which this config enables and the golangci-lint v2
default set does not check at all. That gap is why the drift was invisible:
earlier passes ran gofmt, which is weaker. Mechanical, deterministic,
build+vet verified.

.golangci.yml

@@ -0,0 +1,52 @@
+# Canonical golangci-lint configuration for the estate's Go repos (infra#309
+# pattern: one canonical file here, a byte-identical copy in each adopter,
+# and the drift gate in THIS repo comparing sha256).
+#
+# Why this exists: 26 Go repos, 3 had a lint config, and all three were
+# different. The 23 without one ran golangci-lint's v2 default set, which
+# does NOT include a formatter -- so gofmt/gofumpt drift went uncaught until
+# it was found by hand (dma-cli#12: two files drifted, nothing flagged them).
+#
+# The two configs this replaces (cobalt-dingo, coo-agent) were near-identical
+# copies of each other AND both invalid under v2: they carried v1-style
+# `linters-settings` and `issues.exclude-rules` keys, which `golangci-lint
+# config verify` rejects outright. Their revive settings and test exclusions
+# were therefore not in effect. Consolidating fixes that too.
+#
+# Per-repo variation does NOT belong here -- this file must stay byte-identical
+# across adopters so the gate is a checksum, not a diff a human has to judge.
+# A repo with a genuine exception (agentsquad excludes its seeded-bug fixture
+# tree, which exists precisely to contain broken code) keeps its own config and
+# is not listed as an adopter.
+
+version: "2"
+
+linters:
+  default: none
+  enable:
+    - errcheck # unchecked errors
+    - govet # suspicious constructs
+    - staticcheck # broad static analysis
+    - unused # unused code
+    - misspell # spelling
+    - revive # idiomatic Go
+    - exhaustive # exhaustive switch on enums
+
+  settings:
+    revive:
+      rules:
+        - name: var-naming
+          severity: warning
+
+  exclusions:
+    rules:
+      # Test files: table-driven cases legitimately carry unused struct fields
+      # and long functions.
+      - path: _test\.go
+        linters:
+          - revive
+          - unused
+
+formatters:
+  enable:
+    - gofumpt

internal/eval/eval.go

@@ -13,7 +13,8 @@ import (
 // LinearProbeTrainTest fits ridge regression on (trainEmb, trainY) and evaluates
 // on (testEmb, testY). Returns OOS R². Use this for proper held-out evaluation.
 func LinearProbeTrainTest(trainEmb [][]float64, trainY []float64,
-	testEmb [][]float64, testY []float64, lambda float64) float64 {
+	testEmb [][]float64, testY []float64, lambda float64,
+) float64 {
 	n := len(trainEmb)
 	if n == 0 || len(testEmb) == 0 {
 		return 0

internal/eval/var.go

@@ -64,7 +64,8 @@ func kupiecPOF(n, n1 int, p0 float64) float64 {
 // needs the raw predictions (e.g. to compute VaR breach rate).
 // Returns nil when trainEmb is empty.
 func LinearProbePredict(trainEmb [][]float64, trainY []float64,
-	testEmb [][]float64, lambda float64) []float64 {
+	testEmb [][]float64, lambda float64,
+) []float64 {
 	n := len(trainEmb)
 	if n == 0 || len(testEmb) == 0 {
 		return nil