fix: lint with the repository's pinned Go, and stop filtering to changed code

The lint job failed on this branch with a gofmt-class finding on
client/internal/retry_test.go:46 that no local run reproduces.

The cause is the toolchain, not the code. The job used 'go-version: stable',
which resolved to Go 1.27.0, while go.mod pins 1.26 and the dev shell provides
1.26.5. gofmt is part of this job, and 1.27 aligns that line's end-of-line comment
group differently. Everything else was controlled: same golangci-lint 2.13.0, same
file, same config, a pristine checkout and an empty cache all report a clean tree
under 1.26.5. So the job now takes its Go from go.mod, like the build and test
jobs already do. Linting formatting with a newer toolchain than the code is
written against reports differences no contributor can reproduce.

Dropping only-new-issues is the second half. It exists so a pull request against a
large legacy codebase is not buried in pre-existing findings; this repository
starts clean and CI keeps it clean from the first commit, so filtering to changed
code cannot help and can only hide a real finding. It was hiding this one: the
finding is real under Go 1.27, and the provider's lint job stays green on the same
file only because the flag is set there too and the file is untouched by the pushes
it filters against. That latent drift is still in the provider's workflow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: grubmeshi

.github/workflows/test.yml

@@ -43,17 +43,23 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read  # Required for only-new-issues on PRs
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: stable
+          # The repository's pinned Go, not 'stable'. gofmt is part of this job, and its
+          # formatting changes between Go releases, so linting with a newer toolchain than
+          # the one the code is written against reports differences that no contributor can
+          # reproduce.
+          go-version-file: 'go.mod'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: latest
-          only-new-issues: true  # Show only issues in changed code on PRs
+          # Deliberately no only-new-issues: this repository starts clean and CI keeps
+          # it that way, so filtering to changed code would only hide findings. It also
+          # misreports: filtering a patch that adds a whole directory at once produced a
+          # gci finding on a file that a full run, on two linter versions, calls clean.
       - name: Suggest fix command on failure
         if: failure()
         run: |