ci: migrate to golangci-lint v2.13.2

[yoanbernabeu]

Why

golangci-lint at version: latest is itself built with Go 1.24, so it refuses any module targeting go 1.25.0:

can't load config: the Go language version (go1.24) used to build golangci-lint
is lower than the targeted Go version (1.25.0)

That is the last thing blocking the three pending dependency bumps, which all require Go 1.25:

• deps: bump github.com/qdrant/go-client from 1.17.1 to 1.19.0 #253 qdrant/go-client → 1.19.0
• deps: bump github.com/pgvector/pgvector-go from 0.3.0 to 0.4.1 #254 pgvector-go → 0.4.1
• deps: bump github.com/jackc/pgx/v5 from 5.8.0 to 5.10.0 #228 pgx/v5 → 5.10.0

Their test jobs already pass on the Go 1.25-only matrix (#286) — only Lint fails. golangci-lint v2.13.2 is built with go1.27 and handles them.

Changes

• .github/workflows/ci.yml: golangci-lint-action@v6 → @v9, version: latest → v2.13.2 (pinned, so this can't silently drift again)
• .golangci.yml: migrated with golangci-lint migrate, plus explicit exclusions (see below)
• Makefile: same pinned version, so local and CI agree

About the exclusions

v2 surfaces 46 findings that v1 never reported on this codebase:

linter	count
staticcheck	25 (QF1012 ×10, QF1003 ×8, QF1001 ×4, ST1005 ×3)
noctx	10
prealloc	7
gosec	4 (G122, G602 ×2, G703)

None is an actual defect — there is not a single SA* finding, which is where staticcheck reports real bugs. They are style suggestions (De Morgan's law, tagged switches, error string capitalisation), performance hints, and heuristics.

So they are excluded rather than fixed: this PR keeps exactly the bar the project had before, and touches no production code. Churning config.go, indexer/scanner.go, rpg/model.go and trace/extractor.go for cosmetics — in the same session that already required two CI regression fixes — is not a trade worth making here.

The exclusions are documented in the config and scoped to specific check IDs, so they can be re-enabled one family at a time by anyone who wants to work through them.

The lint is not blind

Verified two ways:

1. golangci-lint run ./... → 0 issues on current main
2. Deliberately misformatted a file → still caught:

   indexer/scanner_test.go:10:1: File is not properly formatted (gofmt)
   

That is the same check that caught the failure fixed in #285, so the gofmt regression that broke main earlier today would still be caught.