[ntwrknrd]

Local container checks could pass while CI rejected formatting, dependency drift, or lint. Use one repository-owned Linux image and shared Make targets for local verification, Linux CI, and the tagged-release verification gate.

Pin the compiler in .go-version (Go 1.25.14, matching the current CI patch level) and the linter in Makefile. Keep the module minimum separate. The image supplies an unprivileged user, private runtime directory, and the matching linter schema for offline configuration validation. Docker, Podman, and nerdctl clients can run the same target.

make verify checks dependencies and formatting without repairs, runs vet/tests, builds both binaries, checks feature output, runs configuration validation and lint, and cross-compiles all four release platforms. Native macOS CI runs the shared core make check target. Remove duplicate PR build/lint jobs; release compilation uses make build while preserving embedded Git metadata. Demo compilation uses the same compiler pin.

Validation:

• Full local container verification passed on Go 1.25.14, including all tests, zero lint issues, and eight cross-built executables.
• Formatting and dependency drift were rejected without modifying inputs; offline schema validation rejected an invalid setting.
• A release-style build retained version, commit, and date metadata.
• Edited workflows passed actionlint; Compose compiler arguments, Markdown, and diff checks passed.
• GitHub Linux verification, native macOS tests, and demo generation all passed on f6462e9.

Local Linux success predicts the shared Linux checks. Native macOS behavior, demo generation, and release publication retain independent CI coverage. Alternate container clients were checked by dry-run; Docker was used for execution.