Fix CI lint: update golangci-lint-action to v7 and clear all findings

[bthall]

The lint job has failed at setup on every push: the v2-format .golangci.yml requires golangci-lint v2, which golangci-lint-action@v6 refuses to install. Bumping to v7 makes lint actually run — and this also clears the 24 findings it then reports:

• errcheck: exclude fmt.Fprint* (CLI writes to stdout; failures are unactionable), explicitly ignore read-only file closes, return the yaml encoder's Close error (it flushes)
• gocritic: run main logic in run() so deferred cleanup executes before os.Exit
• gosec: create the config directory 0o700 instead of 0o755
• staticcheck ST1005: strip trailing punctuation from two error strings
• misspell: cancelled -> canceled in comments
• unused: drop connectTemplate, superseded by hostPaneOptsFor
• gofmt: realign validArrangeLayouts

Verified locally with golangci-lint v2.0.2: 0 issues on this branch.