Use go tool for ci-lint check

[klauspost]

Script is broken. Instead of downloading and executing a script, use go tool for ci-lint check.

Also pins CI check to released versions, etc.

Fixes CI failure:

golangci/golangci-lint info found version: 2.12.2 for v2.12.2/linux/amd64
golangci/golangci-lint err hash_sha256_verify checksum for '/tmp/tmp.OXql2xtJsL/golangci-lint-2.12.2-linux-amd64.tar.gz' did not verify 8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553
fd3a137c7e722128143cc8932bcaa00bc73e10adadee18bdb0893453edb2c137 vs 8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553

[Copilot]

Pull request overview

This PR updates the project’s linting setup to avoid downloading/executing an external installer script and instead run golangci-lint via Go’s tooling mechanism, while also updating/pinning module dependencies accordingly.

Changes:

• Replace the curl | sh golangci-lint installation in make lint with go tool golangci-lint run.
• Add a tool directive for golangci-lint in go.mod, which pulls in tool-related indirect dependencies.
• Update several module versions and regenerate go.sum to reflect the new dependency graph.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Makefile	Switches lint execution to go tool golangci-lint run, removing the installer-script approach.
go.mod	Adds tool directive for golangci-lint and updates/pins dependency versions; introduces many new indirect tool deps.
go.sum	Large regeneration reflecting new/updated (mostly tool-driven) dependencies.

Comments suppressed due to low confidence (2)

Makefile:13

• The previous lint target enforced a 5m timeout; with the current .golangci.yml there is no run.timeout setting, so golangci-lint will fall back to its default timeout (often 1m) and may fail/flap on slower CI runners. Consider re-adding --timeout=5m here (or adding run: { timeout: 5m } to .golangci.yml and keeping this command minimal).

	@mkdir -p ${GOPATH}/bin
	@echo "Running $@ check"
	go tool golangci-lint run

go.mod:30

• This new indirect-require block is entirely tooling-driven (via the tool directive) and dramatically increases go.mod noise. If you keep the tool approach, consider whether these tool-only requires can be isolated (e.g., separate tooling module) so normal consumers don’t carry this dependency surface in their module graph.

require (
	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
	4d63.com/gochecknoglobals v0.2.2 // indirect
	charm.land/lipgloss/v2 v2.0.3 // indirect
	codeberg.org/chavacava/garif v0.2.0 // indirect
	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ramondeklein]

Please upgrade gomodguard linter in .golangci.yml to gomodguard_v2 to fix warning:

WARN The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2.
WARN Suggested new configuration:
linters:
  enable:
    - gomodguard_v2

[klauspost]

@ramondeklein Done.