🐛 fix(ci): bump golangci-lint to v2.13.1 for Go 1.27 support

[konih]

What

Bumps GOLANGCI_LINT_VERSION from v2.12.2 to v2.13.1 in .github/workflows/verify.yaml. One env: line, plus a comment recording the failure signature and the diagnosis heuristic. Zero Go bytes changed.

Why

verify was red on every PR — including six-file Markdown diffs with no Go in them — with:

/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2:
  could not import math/rand/v2 (… method must have no type parameters) (typecheck)

The failing path is inside the Go toolchain's own source tree, so no author change can fix it and a re-run cannot clear it.

Mechanism: golangci-lint typechecks the standard library with the go/types it was compiled with, not the go on PATH. GitHub's go-version: stable rolled Go 1.26 → 1.27.0 between the last green main run and today. The v2.12.2 release binary is built with go1.26.4 and cannot read the Go 1.27.0 stdlib. v2.13.1 is built with go1.27.0 and can.

Diagnosis heuristic worth keeping: golangci-lint's own go.mod carries the comment "the minimum Go version must always be latest-1", so its go directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says go 1.25.0 (supports ≤ 1.26), v2.13.1 says go 1.26.0 (supports ≤ 1.27).

Scope of the one line

The pin is single-sourced at workflow scope (D-128), so this one line fixes both exposed sites at once: the golangci-lint-action in the verify job and the go install golangci-lint@$GOLANGCI_LINT_VERSION in release-exitgate. go-version: stable is deliberately kept — pinning Go instead would need two pins, leave the bug class live, and trade a loud recurrence for silent drift onto an unsupported Go in a repo running govulncheck + cosign + SLSA + Scorecard.

Evidence

Reproduced locally rather than reasoned:

• Go 1.27.0 on PATH, GOTOOLCHAIN=local, whole tree: v2.12.2 → panic in go/types.(*Checker).Files, exit 2; v2.13.1 → 0 issues, exit 0.
• v2.13.1 against local Go 1.26.6 → 0 issues — safe for contributors who have not moved.
• golangci-lint config verify → exit 0, so .golangci.yml needs no schema migration.
• go install …@v2.13.1 under Go 1.27.0 → 0 issues (the release-exitgate path, which is pull_request-skipped and therefore never exercised by a PR).

Zero new lint findings tree-wide under both Go 1.26.6 and Go 1.27.0.

Verification

This PR's own verify run is the test of the fix: pull_request runs use the workflow from the PR merge ref, so a green verify here is the reproduction of the remedy.

Local gate matrix: task check green, task changelog-verify green.

Residual risk

When stable rolls to Go 1.28, v2.13.1 will break identically. The repo finds out loudly (every PR reds, including zero-Go diffs) and the fix is again one env line — the signature is recorded in the workflow comment. Nothing detects it earlier: dependabot's github-actions ecosystem updates uses: refs, not env: literals. Tracked as CI-TOOLCHAIN-F01 in the backlog.

Decision row: D-158.