ci(golangci-lint): enable strict lint gate

[cssbruno]

Summary

• Adds a strict golangci-lint v2.12.2 configuration, pinned local runner, and GitHub Actions lint workflow.
• Fixes the findings surfaced by the enabled linters without adding a baseline or exclude list.
• Removes unused internal helpers where lint proved they were dead code.
• Updates CI documentation for the new lint gate.

Issue Closure

Related: lint gate hardening; no issue auto-close.

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.
• I considered security-sensitive surfaces such as auth, CSRF, redirects, request-time handlers, logs, diagnostics, embedded assets, editor commands, WASM, contracts, and realtime behavior.

Commands run:

• scripts/check-golangci-lint.sh -> 0 issues.
• go test ./internal/publicapi -count=1
• go test ./internal/gowdkcmd -run 'TestBuildCommandProductionScansFinalArtifactsForSecrets|TestBuildCommandProductionBlocksInsecureAuditFindings|TestComputeAuditDiffClassifiesIntroducedResolvedUnchanged' -count=1
• go build ./cmd/gowdk
• git diff --check

Known gap: full go test ./... was attempted earlier, but the existing nested internal/gowdkcmd integration tests ran excessively long. This PR is validated with the lint gate and focused tests for the touched late fixes.

LLM Assistance

• LLM session summary: Codex added the strict lint config and runner, fixed lint findings across the repository, rebased the work onto current main, resolved conflicts, and opened this draft PR.
• Human-reviewed assumptions: no golangci baseline or exclude list should be used; dead unused helpers can be deleted when no call sites remain.
• Follow-up work: run the full repository/module test suite in CI or an environment where the long internal/gowdkcmd integration tests can complete.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bddd2aec3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid PATH lookup before sandbox confinement

In hosted playground runs, resolveGoRoot executes before LaunchSandbox/ConfineToSandbox and now resolves go through the host PATH. If that environment contains an attacker-writable directory, submitted code can supply a fake go that runs outside the sandbox or returns an arbitrary GOROOT to mount, undermining the fail-closed sandbox boundary. Use the baked-in runtime.GOROOT() or another trusted absolute toolchain path instead.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve the inbound Host in the dev proxy

For requests proxied by gowdk dev, ProxyRequest.SetURL rewrites the outbound Host to the runtime target port, unlike the previous NewSingleHostReverseProxy behavior. The runtime's safeRedirectPath accepts an absolute same-origin Referer only when it matches request.Host, so browser redirects from the dev host (for example cookie acknowledgement back to 127.0.0.1:8080/foo) now see request.Host as the hidden runtime port and fall back to /. Set proxyRequest.Out.Host = proxyRequest.In.Host after SetURL.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve JSON encoding for build data strings

When a build {} object/list contains a string with a control byte (for example "\x00"), buildFieldValueFromString unquotes it into a NUL byte and this line serializes it with strconv.Quote, producing Go-only escapes such as "\x00" instead of valid JSON (json.Valid rejects that form). The comment and downstream build-data map expect canonical JSON text, so generated data can no longer be parsed by JSON clients; keep using encoding/json for strings and object keys.

Useful? React with 👍 / 👎.