chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

Canonical lives at infra ci-templates/golangci.yml, distributed by the
infra#309 pattern: byte-identical copies, checksum drift gate in infra. Do
not edit this file here -- edit the canonical and run `task ci:sync`.

Verified locally before pushing, not pushed-and-hoped: golangci-lint v2.11.4
against a Go 1.26.1 toolchain (matching CI) reports 0 issues here.

Also applies gofumpt, which this config enables and the golangci-lint v2
default set does not check at all. That gap is why the drift was invisible:
earlier passes ran gofmt, which is weaker. Mechanical, deterministic,
build+vet verified.

internal/eval/eval.go

@@ -13,7 +13,8 @@ import (
 // LinearProbeTrainTest fits ridge regression on (trainEmb, trainY) and evaluates
 // on (testEmb, testY). Returns OOS R². Use this for proper held-out evaluation.
 func LinearProbeTrainTest(trainEmb [][]float64, trainY []float64,
-	testEmb [][]float64, testY []float64, lambda float64) float64 {
+	testEmb [][]float64, testY []float64, lambda float64,
+) float64 {
 	n := len(trainEmb)
 	if n == 0 || len(testEmb) == 0 {
 		return 0

internal/eval/var.go

@@ -64,7 +64,8 @@ func kupiecPOF(n, n1 int, p0 float64) float64 {
 // needs the raw predictions (e.g. to compute VaR breach rate).
 // Returns nil when trainEmb is empty.
 func LinearProbePredict(trainEmb [][]float64, trainY []float64,
-	testEmb [][]float64, lambda float64) []float64 {
+	testEmb [][]float64, lambda float64,
+) []float64 {
 	n := len(trainEmb)
 	if n == 0 || len(testEmb) == 0 {
 		return nil