refactor: standardize linting and error handling across codebase

[appleboy]

• Add and configure multiple new linters and settings in the golangci-lint configuration, while removing some previously enabled linters
• Add fine-grained linter rules, revive linter rules, and specific issue limits in lint configuration
• Switch several for-loops in tests and code from explicit indexing to range-based iteration for improved readability
• Replace fmt.Errorf with errors.New for static error strings to standardize error construction
• Import the errors package and strconv where needed for the new error handling approach and int-string conversions
• Update test code comments for clarity about direct HTTP calls to the local server
• Add missing error imports in test files to support new error usage
• Improve code style and add additional configuration for code formatters
• Add comments explaining specific os.Exit return codes

[Copilot]

Pull request overview

This PR standardizes linting and error-handling conventions in the Go codebase by expanding/adjusting golangci-lint configuration and applying small refactors across runtime and test code.

Changes:

• Updated .golangci.yml to enable a new set of linters (depguard/revive/etc.), configure rules/settings, and enable additional formatters.
• Refactored several counted for loops to Go’s integer range form for readability.
• Standardized construction of static errors by replacing fmt.Errorf("...") with errors.New("..."), and replaced fmt.Sprintf("%d", n) with strconv.Itoa(n).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
.golangci.yml	Adds/enables linters and config rules; adjusts formatter settings and issue limits.
main.go	Uses errors.New for static errors and strconv.Itoa for int→string conversion; clarifies an os.Exit nolint comment.
callback_test.go	Switches one static error to errors.New and adds clarifying comments on direct HTTP calls.
filelock.go	Refactors retry loop to integer range.
filelock_test.go	Refactors goroutine-spawning loop to integer range.
pkce_test.go	Refactors iteration loops to integer range.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This file uses //nolint:noctx,gosec, but .golangci.yml no longer enables noctx or gosec and nolintlint.allow-unused is false. That combination will cause golangci-lint to fail due to unused/unknown nolint directives. Either re-enable those linters or remove the noctx,gosec nolint (keep a plain comment if you still want the rationale).

Suggested change

	resp, err := http.Get(callbackURL) //nolint:noctx,gosec // test: direct GET to local server
	resp, err := http.Get(callbackURL) // test: direct GET to local server

[Copilot]

This //nolint:noctx,gosec directive will be considered unused because noctx/gosec are not enabled in .golangci.yml while nolintlint.allow-unused=false, which will fail CI. Remove the nolint (or re-enable the linters).

Suggested change

	resp, err := http.Get(callbackURL) //nolint:noctx,gosec // test: direct GET to local server
	resp, err := http.Get(callbackURL) // test: direct GET to local server

[Copilot]

This //nolint:noctx,gosec directive will be flagged by nolintlint as unused/unknown (since those linters are disabled), causing lint failure. Remove it (or re-enable noctx/gosec).

[Copilot]

//nolint:noctx,gosec is likely to fail nolintlint because noctx/gosec are not enabled in .golangci.yml and unused nolints are disallowed. Remove the nolint (or re-enable those linters).

[Copilot]

This //nolint:noctx,gosec will be reported as unused by nolintlint unless noctx/gosec are enabled. With the updated .golangci.yml it will break lint; remove it or re-enable the linters.

[Copilot]

This //nolint:noctx,gosec directive will be considered unused under the updated linter set (noctx/gosec disabled) with nolintlint.allow-unused=false. Remove it (or re-enable the linters) to avoid CI failure.

[Copilot]

With nolintlint.allow-unused: false and require-specific: true, any //nolint:<linter> must reference an enabled linter. The codebase currently contains //nolint:noctx,gosec (e.g., in callback_test.go), but noctx and gosec are not enabled here, so lint will fail. Either enable those linters again or remove/update those nolint directives.