ci: expand the lint config, make make fix converge

[min0625]

What

Second pass over the lint setup after #59, plus a make fix that actually
converges.

Formatters — re-add gci. #59 dropped it as covered by
gofumpt+goimports, but those two only sort within the groups a file
already has. Checked on cmd/mint/main.go with cobra moved into the stdlib
block:

	result
gofumpt+goimports	cobra ends up in a third group of its own
+ gci	merged back into the existing third-party group

So it earns its slot; #59's reasoning was wrong on that point.

replace guard — swap gomodguard_v2.local-replace-directives for the
gomoddirectives linter. gomodguard only sees directly imported modules, so
an indirect dep's replace slipped through. Verified gomoddirectives rejects
a resolvable non-local replace by default, not just => ../local:

go.mod:27:1: replacement are not allowed: github.com/spf13/cobra (gomoddirectives)

depguard retired — its single rule (github.com/pkg/errors) moves into
the gomodguard_v2 blocklist, next to the other deprecated modules.
mitchellh/mapstructure and gopkg.in/yaml (prefix match, both majors) join
it.

New linters — bidichk, makezero, reassign. reassign gets
patterns: [".*"] per upstream's own recommendation; the default only guards
EOF and Err*, leaving os.Args and http.DefaultClient open. Tests are
excluded from it — they borrow os.Stdin/os.Args and restore them.

Settings — errcheck.check-type-assertions on;
prealloc.for-loops on (modernize rewrites 3-clause loops into the range
form prealloc polices, so with the default the finding only surfaces after
--fix); perfsprint.concat-loop off (modernize rewrites the same pattern
better, reusing the variable instead of inventing one).

gosec G104 excluded — it fires on bare call statements only (never
defer/go) and honors a whitelist, so it is a strict subset of errcheck,
which also names the offending function. With uniq-by-line: false both would
print on the same line. Narrowing errcheck (exclude-functions,
std-error-handling) would reopen the gap — noted in the config.

make fix — now tidy → --fix → tidy → lint. --fix is not a fixpoint:
its own edits can trip a linter the fixing run never saw, and can add or remove
imports.

check-rev rationale corrected — #58 documented golangci-lint as only
warning and exiting 0 on an unresolvable --new-from-rev, which would let CI
pass having linted nothing. It does not: it warns, reports every issue in the
repo, and exits 1. The guard stays, but the Makefile comment and AGENTS.md
now say what it actually buys — a readable error message, not safety.

Docs — AGENTS.md also gains a note that .golangci.yaml is not
self-contained: whole-files: true is silently inert without one of the
--new* modes, so the file only works alongside the Makefile's
--new-from-rev harness. And that formatter findings are the exception to the
ratchet — apply golangci-lint fmt ./... repo-wide rather than leave a
half-formatted tree contradicting its own config.

Verification

• golangci-lint config verify — clean
• golangci-lint run ./... (no --new-from-rev) — 0 issues repo-wide, so
  the whole-files ratchet takes on no new debt
• make check (full prek suite, the CI gate) — all hooks pass
• make fix — exits 0, leaves the tree unchanged

Note on scope: the make fix run above exercised the new
tidy → --fix → tidy → lint plumbing on a clean tree. It confirms the ordering
runs, not that the second pass caught a real fixpoint miss.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!