golangci-lint: most of .golangci.yaml never runs

[plombardi89]

Found during review of #655.

.golangci.yaml never sets linters.default. Under golangci-lint v2 that means only the standard set runs — plus the two we enable explicitly, goheader and wsl_v5.

Everything else in the file is inert. The linters-settings blocks for varnamelen, godot, godox, nolintlint and the rest configure linters that are never invoked, so they read as active policy and enforce nothing.

Why it matters beyond tidiness

Several linters that are off would catch real classes of bug we have hit:

• nilerr — returning nil when a non-nil error is in scope. relctl: one implementation of the versioning rule, shared by humans and CI #655 shipped two of these (return nil, nil on a git failure), one of which marked a release Latest because a query broke. Both were caught by human review.
• predeclared — shadowing builtins. A local named max got through.
• containedctx — a context.Context stored in a struct.
• exhaustive — a switch over a typed enum with no default.

What this changes about a green build

A passing make lint currently says less than the config implies. That is worth knowing when weighing "lint is clean" as evidence in a review, which is roughly how it gets used.

Suggested approach

Turning everything on at once will surface findings across the whole tree, so this probably wants to be incremental: set linters.default, enable the inert linters one at a time, and fix or explicitly disable each. Starting with nilerr and predeclared would have the best ratio of caught bugs to churn.

Pre-existing and repo-wide, not specific to any one change.