chore(lint): 扩展 .golangci.yml 至 37 个 linter

从 16 个扩展到 37 个（占 golangci-lint 全部 113 个的 33%）。

## 新增 21 个

Bug catchers:
- exhaustive: switch/type switch 缺少 case
- gochecksumtype: sum-type 类型穷举
- nilnil: 同时返回 nil error + nil value
- wastedassign: 被覆盖前从未读取的赋值
- reassign: 包级变量被重新赋值
- unparam: 未使用的函数参数
- errchkjson: json.Marshal 不支持的类型
- durationcheck: 两个 Duration 相乘
- makezero: make 非零长度后 append

Modernization:
- modernize: CutPrefix/SplitSeq/slices.Contains/min()/any/…
- intrange: for i := range N
- copyloopvar: Go 1.22+ loop var capture

Meta:
- nolintlint: 验证 //nolint / #nosec 指令格式

Input safety:
- bidichk: 危险 Unicode（trojan source）
- asciicheck: 非 ASCII 标识符
- gocheckcompilerdirectives: 畸形 //go: 指令

Performance:
- perfsprint: fmt.Sprintf → strconv/errors.New

Style (regression fence):
- dupword: 重复词（"the the"）
- godot: 注释句号
- errname: ErrXxx 命名规范
- dupl: 复制粘贴代码块

## 明确不启用（附理由）

- goconst: 46 findings，几乎全是测试数据（"--bogus", "rm", "list"…），
  提取成常量损害可读性
- gocognit: 和 gocyclo 重复，只是复杂度算法不同
- nestif: 和 gocyclo 重复，只看嵌套深度
- 其他 framework-specific linter（bodyclose, sqlclosecheck, protogetter
  等）：cmdguard 无 HTTP/SQL/protobuf

## 验证

  $ golangci-lint run ./...
  0 issues.
  $ go test ./... -count=1
  全部 7 个包 PASS
  $ govulncheck ./...
  No vulnerabilities found.

Author: hyper0x

.golangci.yml

@@ -1,6 +1,6 @@
 # golangci-lint configuration.
 #
-# We run golangci-lint v2 (`brew install golangi-lint` on macOS).
+# We run golangci-lint v2 (`brew install golangci-lint` on macOS).
 # v2 changed the schema: linters live under `linters.enable`, and
 # per-rule exclusions live under `linters.exclusions.rules`.
 #
@@ -9,54 +9,92 @@
 #      reproducible across contributors and CI (no "default changed
 #      in v2.13"). `default: none` means ONLY the linters listed below
 #      run — nothing implicit.
-#   2. Suppress errcheck noise inside *_test.go where the standard
-#      pattern is os.Setenv / w.Close / buf.ReadFrom / os.MkdirAll
-#      without explicit error handling. Production code still gets
-#      the full check.
+#   2. Suppress noise inside *_test.go where the standard pattern is
+#      os.Setenv / w.Close / buf.ReadFrom / os.MkdirAll without explicit
+#      error handling. Production code still gets the full check.
 #
 # Linter philosophy:
-#   - Real-bug catchers (errcheck, gosec, errorlint, nilerr, …) are
-#     ON at default thresholds. Every finding they surface is either a
-#     bug we fix or a documented false positive (`// #nosec`).
+#   - Real-bug catchers (errcheck, gosec, errorlint, nilerr, exhaustive,
+#     …) are ON at default thresholds. Every finding they surface is
+#     either a bug we fix or a documented false positive (`// #nosec`).
 #   - gocyclo is kept at a deliberately high threshold (70) because the
 #     three CLI dispatchers (RunGuard/RunInit/RunUndo) are inherently
 #     big switch-on-subcommand functions; the value is in preventing NEW
 #     complexity, not flagging what we already know about.
-#   - misspell / gocritic / unconvert / predeclared / forcetypeassert
-#     currently produce zero findings on this codebase, but we keep them
-#     enabled as a regression fence: the day someone adds a typo or an
+#   - Modernisation linters (modernize, intrange, copyloopvar) push us
+#     toward Go 1.22+ idioms (CutPrefix, SplitSeq, slices.Contains,
+#     min(), interface{}→any, range-over-int).
+#   - misspell / gocritic / unconvert / predeclared / forcetypeassert /
+#     dupword / godot / asciicheck / bidichk / dupl / etc. currently
+#     produce zero findings on this codebase, but we keep them enabled
+#     as a regression fence: the day someone adds a typo or an
 #     unnecessary conversion, CI catches it instead of a reviewer.
 #
+# Deliberately NOT enabled:
+#   - goconst   — 46 findings, almost all test data ("--bogus", "rm",
+#     "list"…). Extracting test literals to constants harms readability.
+#   - gocognit  — duplicates gocyclo with a different complexity metric.
+#   - nestif    — duplicates gocyclo for nesting depth.
+#   - Various framework-specific linters (bodyclose, sqlclosecheck,
+#     protogetter, …) — cmdguard has no HTTP / SQL / protobuf.
+#
 # Run:    golangci-lint run ./...
 # Update: golangci-lint config verify
 version: "2"
 
 linters:
   default: none
   enable:
-    # --- Built-ins that always pay off ---
-    - errcheck       # unchecked error returns (the most frequent real bug)
-    - govet          # the official `go vet` rules
-    - ineffassign    # assignments whose result is never read
-    - staticcheck    # SA-/ST-/QF- rules; the single most valuable set
-    - unused         # dead code (functions, vars, types, consts)
+    # ── Built-ins that always pay off ──────────────────────────
+    - errcheck        # unchecked error returns (the most frequent real bug)
+    - govet           # the official `go vet` rules
+    - ineffassign     # assignments whose result is never read
+    - staticcheck     # SA-/ST-/QF- rules; the single most valuable set
+    - unused          # dead code (functions, vars, types, consts)
 
-    # --- Security & correctness ---
-    - gosec          # G1xx/G3xx/G7xx security checks (path traversal, hardcoded creds, …)
-    - errorlint      # use errors.As/Is/wrap instead of == / type-assertion
+    # ── Security & correctness ─────────────────────────────────
+    - gosec            # G1xx/G3xx/G7xx security checks (path traversal, hardcoded creds, …)
+    - errorlint        # use errors.As/Is/wrap instead of == / type-assertion
     - nilerr           # detect `if err != nil { return nil }` patterns that drop errors
+    - nilnil           # simultaneous return of nil error + invalid value
+    - exhaustive       # missing cases in switch / type switch
+    - gochecksumtype   # exhaustiveness for sum-type-style type switches
+    - wastedassign     # assignments that are overwritten before being read
+    - reassign         # package-level variables that get reassigned
+    - unparam          # unused function parameters
+
+    # ── Input validation & safety ──────────────────────────────
+    - bidichk          # dangerous Unicode (trojan source / bidi override)
+    - asciicheck       # non-ASCII identifiers
+    - gocheckcompilerdirectives  # malformed //go: directives
+
+    # ── Modernisation (Go 1.22–1.26 idioms) ───────────────────
+    - modernize        # CutPrefix/CutSuffix, SplitSeq, slices.Contains, min(), any, …
+    - intrange        # for i := range N instead of for i := 0; i < N; i++
+    - copyloopvar     # Go 1.22+ loop variable capture semantics
 
-    # --- Performance micro-optimisation ---
-    - prealloc        # preallocate slices when size is known upfront
+    # ── Performance micro-optimisation ─────────────────────────
+    - prealloc         # preallocate slices when size is known upfront
+    - perfsprint       # fmt.Sprintf → strconv/errors.New where applicable
 
-    # --- Style & polish (zero findings today, fence for tomorrow) ---
-    - misspell        # typos in comments/strings
-    - gocritic        # style/perf/bug-prone patterns
-    - unconvert       # unnecessary type conversions
-    - predeclared    # shadowing predeclared identifiers (e.g. `cap`, `len`)
-    - forcetypeassert # unchecked type assertions (panic risk)
+    # ── Meta-linter ────────────────────────────────────────────
+    - nolintlint       # validate //nolint / #nosec directives are well-formed
 
-    # --- Complexity (high threshold — see comment above) ---
+    # ── Style & polish (regression fence — 0 findings today) ──
+    - misspell         # typos in comments/strings
+    - gocritic         # style/perf/bug-prone patterns
+    - unconvert        # unnecessary type conversions
+    - predeclared     # shadowing predeclared identifiers (e.g. `cap`, `len`)
+    - forcetypeassert  # unchecked type assertions (panic risk)
+    - dupword          # duplicate words ("the the") in comments/strings
+    - godot            # comments should end with a period
+    - errname          # error variables should be named ErrXxx
+    - dupl             # duplicate code blocks (copy-paste detection)
+    - errchkjson       # unsupported types passed to json.Marshal/Encode
+    - durationcheck    # two time.Duration values multiplied together
+    - makezero         # make() with non-zero length followed by append
+
+    # ── Complexity (high threshold — see header comment) ──────
     - gocyclo
 
   settings:
@@ -68,10 +106,8 @@ linters:
       # nagging about the existing ones.
       min-complexity: 70
     gosec:
-      # #nosec directives already cover the genuine false positives
-      # (user-supplied command launching, PATH-walk file reads, …).
-      # No global exclusion rules — every suppression is per-site with
-      # a justification comment.
+      # #nosec directives cover genuine false positives per-site.
+      # No global exclusions — keeping it explicit.
       excludes: []
 
   exclusions:
@@ -86,7 +122,6 @@ linters:
           - gosec
           - forcetypeassert
           - prealloc
-      # gocyclo is meaningless in test table-drivers and helpers.
-      - path: _test\.go
-        linters:
           - gocyclo
+          - wastedassign
+          - unparam