Make the linter able to read Go 1.27 code, and fail loudly when it cannot

[Sulaiman-Dauda]

What this changes

The lint step has not linted anything since GitHub's stable Go moved to 1.27.1. golangci-lint v2.12.2 is built with Go 1.26 and cannot type-check the 1.27 standard library. Every run on main reported the same two errors, both in the Go install's crypto/internal/randutil failing to import math/rand/v2, and no findings from our code. continue-on-error kept the job green, so nothing showed it.

• golangci-lint moves to v2.14.0, which is built with Go 1.27.0 (read from the release binary's build info, checksum verified).
• A new step, "Check golangci-lint supports this Go", compares the Go version the linter was built with against the toolchain and fails the job if the toolchain is newer, or if it cannot read the linter's version at all (for example when the install failed). It is not covered by continue-on-error, so the next Go release turns this job red instead of silently switching the linter off. The fix then is a one-line version bump.
• The comment above the step is shorter and points at Clear the lint backlog and make golangci-lint blocking again #8, the backlog issue. It used to cite build(deps): Bump the go-minor-patch group with 3 updates #1, which is an old Dependabot PR.

The findings stay advisory, as agreed in #8. Run locally with v2.14.0 there are 135, of which 133 are errcheck, one ineffassign (internal/agent/local/proxy.go:205) and one staticcheck S1016 (internal/agent/local/host.go:55).

Trade-off to know about

When a new Go release reaches stable before golangci-lint ships a build for it, every PR's "Lint + unit tests" check goes red until the version here is bumped. That is deliberate, since a green check while the linter cannot read the code is the bug this fixes. If that is too strict, the guard can print a warning instead of failing.

How it was verified

• The guard script is taken from ci.yaml and run under bash -e, which is what Actions uses for a run: step with no shell: (no pipefail). A fake go drives 8 cases. It passes when the linter's Go matches or is newer, including a patch difference and a X:boringcrypto suffix. It fails when the toolchain is newer (go1.28.0, go1.28rc1), when golangci-lint is not installed, and when either version cannot be read.
• Review found that the first version passed when golangci-lint was missing, because the empty version made the numeric test error and if read that as false. That is the silent failure this step exists to catch. It is fixed in the second commit, and the 8 cases above failed 3 of 8 before it.
• This PR's CI run shows golangci-lint v2.14.0 reporting 135 issues in our own code (133 errcheck, 1 ineffassign, 1 staticcheck), and the guard printing golangci-lint built with go1.27.0, toolchain go1.27.1. On main the same step reports only the 2 standard library errors.

Refs #8

🤖 Generated with Claude Code