Summary

• Adds a strict golangci-lint v2.12.2 configuration, pinned local runner, and GitHub Actions lint workflow.
• Fixes the findings surfaced by the enabled linters without adding a baseline or exclude list.
• Removes unused internal helpers where lint proved they were dead code.
• Updates CI documentation for the new lint gate.

Issue Closure

Related: lint gate hardening; no issue auto-close.

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.
• I considered security-sensitive surfaces such as auth, CSRF, redirects, request-time handlers, logs, diagnostics, embedded assets, editor commands, WASM, contracts, and realtime behavior.

Commands run:

• scripts/check-golangci-lint.sh -> 0 issues.
• go test ./internal/publicapi -count=1
• go test ./internal/gowdkcmd -run 'TestBuildCommandProductionScansFinalArtifactsForSecrets|TestBuildCommandProductionBlocksInsecureAuditFindings|TestComputeAuditDiffClassifiesIntroducedResolvedUnchanged' -count=1
• go build ./cmd/gowdk
• git diff --check

Known gap: full go test ./... was attempted earlier, but the existing nested internal/gowdkcmd integration tests ran excessively long. This PR is validated with the lint gate and focused tests for the touched late fixes.

LLM Assistance

• LLM session summary: Codex added the strict lint config and runner, fixed lint findings across the repository, rebased the work onto current main, resolved conflicts, and opened this draft PR.
• Human-reviewed assumptions: no golangci baseline or exclude list should be used; dead unused helpers can be deleted when no call sites remain.
• Follow-up work: run the full repository/module test suite in CI or an environment where the long internal/gowdkcmd integration tests can complete.