chore(agent): fix golangci-lint failures under the docker build tag

gofumpt alignment in getWrappedCommand, and move the fakeGosshConn test
helper into the !docker test file where its only user lives so it is not
flagged as unused when building with -tags docker.

Author: otavio

agent/server/modes/host/command/command_docker.go

@@ -85,7 +85,8 @@ func getWrappedCommand(nsArgs []string, uid, gid uint32, groups []uint32, home s
 		"1",
 	}, nsArgs...)
 
-	nsenterCmd = append(nsenterCmd,
+	nsenterCmd = append(
+		nsenterCmd,
 		[]string{
 			"-S",
 			strconv.Itoa(int(uid)),

agent/server/modes/host/sessioner_native_test.go

@@ -3,6 +3,8 @@
 package host
 
 import (
+	"errors"
+	"net"
 	"os/exec"
 	"sync/atomic"
 	"testing"
@@ -15,6 +17,36 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 )
 
+// fakeGosshConn is a minimal implementation of gossh.Conn that can be embedded
+// in a gossh.ServerConn so tests can inject a ServerConn into the session context
+// without needing a real SSH network connection.
+type fakeGosshConn struct{}
+
+func (f *fakeGosshConn) User() string          { return "root" }
+func (f *fakeGosshConn) SessionID() []byte     { return nil }
+func (f *fakeGosshConn) ClientVersion() []byte { return nil }
+func (f *fakeGosshConn) ServerVersion() []byte { return nil }
+func (f *fakeGosshConn) RemoteAddr() net.Addr  { return &net.TCPAddr{} }
+func (f *fakeGosshConn) LocalAddr() net.Addr   { return &net.TCPAddr{} }
+func (f *fakeGosshConn) SendRequest(_ string, _ bool, _ []byte) (bool, []byte, error) {
+	return false, nil, nil
+}
+
+func (f *fakeGosshConn) OpenChannel(_ string, _ []byte) (gossh.Channel, <-chan *gossh.Request, error) {
+	return nil, nil, errors.New("not implemented")
+}
+
+func (f *fakeGosshConn) Close() error { return nil }
+
+// Wait blocks until the returned channel is closed — used by tests to
+// control when the "kill on disconnect" goroutine unblocks.
+func (f *fakeGosshConn) Wait() error {
+	// Block until the test is done (goroutine is abandoned when the test
+	// function returns; the Go runtime cleans it up). This is acceptable
+	// because the caller only needs Wait to not panic.
+	select {}
+}
+
 // TestExec_NonPty_SucceedingCommand is a regression guard for the non-PTY path of
 // Exec(). It verifies that:
 //   - a real command starts and completes

agent/server/modes/host/sessioner_test.go

@@ -120,6 +120,9 @@ func newFakeSession(sessionID, user string) *fakeSession {
 	}
 }
 
+// Ensure gossh.Channel is satisfied (compile-time check via assignment).
+var _ gossh.Channel = (*fakeSession)(nil)
+
 // TestFakeSessionCompiles is a compile-time check that fakeSession fully
 // implements gliderssh.Session. The test body is intentionally empty — a build
 // failure means the interface is incomplete.
@@ -140,39 +143,6 @@ func TestFakeSessionCompiles(t *testing.T) {
 	}
 }
 
-// Ensure gossh.Channel is satisfied (compile-time check via assignment).
-var _ gossh.Channel = (*fakeSession)(nil)
-
-// fakeGosshConn is a minimal implementation of gossh.Conn that can be embedded
-// in a gossh.ServerConn so tests can inject a ServerConn into the session context
-// without needing a real SSH network connection.
-type fakeGosshConn struct{}
-
-func (f *fakeGosshConn) User() string          { return "root" }
-func (f *fakeGosshConn) SessionID() []byte     { return nil }
-func (f *fakeGosshConn) ClientVersion() []byte { return nil }
-func (f *fakeGosshConn) ServerVersion() []byte { return nil }
-func (f *fakeGosshConn) RemoteAddr() net.Addr  { return &net.TCPAddr{} }
-func (f *fakeGosshConn) LocalAddr() net.Addr   { return &net.TCPAddr{} }
-func (f *fakeGosshConn) SendRequest(_ string, _ bool, _ []byte) (bool, []byte, error) {
-	return false, nil, nil
-}
-
-func (f *fakeGosshConn) OpenChannel(_ string, _ []byte) (gossh.Channel, <-chan *gossh.Request, error) {
-	return nil, nil, errors.New("not implemented")
-}
-
-func (f *fakeGosshConn) Close() error { return nil }
-
-// Wait blocks until the returned channel is closed — used by tests to
-// control when the "kill on disconnect" goroutine unblocks.
-func (f *fakeGosshConn) Wait() error {
-	// Block until the test is done (goroutine is abandoned when the test
-	// function returns; the Go runtime cleans it up). This is acceptable
-	// because the caller only needs Wait to not panic.
-	select {}
-}
-
 // TestShell_StartPtyError verifies that Shell() returns an error and does NOT
 // panic when startPtyFn fails (e.g. "ptmx: inappropriate ioctl for device").
 // Before the fix the nil *os.File returned by the stub was dereferenced, causing