ci(golangci-lint): bump action v6 → v8 + migrate config to v2 (Go 1.25)

Action v6 resolved to golangci-lint v1.64.8 (built with Go 1.24), which
fails to load configs targeting Go 1.25. Action v8 ships golangci-lint
v2.x which is Go 1.25-compatible.

Config migrated to v2 format: removed gosimple (folded into staticcheck),
moved exclude-rules under linters.exclusions, added version: "2" header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

.github/workflows/golangci-lint.yml

@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [master, main]
   schedule:
-    - cron: '23 6 * * 1'
+    - cron: "23 6 * * 1"
 
 permissions:
   contents: read
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: common/go.mod
-      - uses: golangci/golangci-lint-action@v6
+      - uses: golangci/golangci-lint-action@v8
         with:
           version: latest
           working-directory: common

.golangci.yml

@@ -1,31 +1,31 @@
-# golangci-lint config — start conservative, expand once baseline is clean
+# golangci-lint v2 config — start conservative, expand once baseline is clean
+version: "2"
+
 run:
   timeout: 5m
   tests: true
 
 linters:
+  # Default linter set is govet+errcheck+ineffassign+staticcheck+unused.
+  # We explicitly add misspell + gocyclo on top. gosimple folded into staticcheck in v2.
   enable:
     - errcheck       # checks unchecked errors
-    - gosimple       # simplification suggestions
     - govet          # standard vet
     - ineffassign    # ineffective assignments
-    - staticcheck    # bug detection
+    - staticcheck    # bug detection (subsumes gosimple in v2)
     - unused         # unused code
     - misspell       # spelling
     - gocyclo        # cyclomatic complexity
-  disable:
-    - gosec          # security covered by govulncheck + CodeQL already
-    - dupl           # too noisy on fresh codebases
-
-linters-settings:
-  gocyclo:
-    min-complexity: 20  # generous default
+  settings:
+    gocyclo:
+      min-complexity: 20
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - errcheck
+          - gocyclo
 
 issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck     # tests routinely ignore err
-        - gocyclo
   max-issues-per-linter: 0
   max-same-issues: 0