fix(build): run golangci-lint via go run, unbreak make janitor

[batmac]

make janitor was broken:

can't load config: the Go language version (go1.26) used to build golangci-lint
is lower than the targeted Go version (1.27.0)

My miss in #1166: that PR migrated the config to v2 but left the Makefile and the pre-commit hook invoking whatever golangci-lint happens to be in $PATH — still v1.64.8 built with Go 1.26 here. Building the linter with go run means the local toolchain compiles it, so it always targets the same Go version as go.mod.

Four fixes, each found by actually running the target until it exited 0:

1. golangci-lint via go run (pinned @v2.13.1, like GOSEC/GOFUMPT/GOVULNCHECK), in both the Makefile and .pre-commit-config.yaml. The pre-commit hook had the identical problem — it is skipped on pre-commit.ci, so it only ever failed locally.
2. --disable-all -E misspell → --enable-only misspell — v2 removed the old flag pair.
3. gosec: -exclude-dir=old — the gitignored old/ scratch directory contains a second module and broke gosec's package loading (found packages openers and main in old/magnet).
4. govulncheck: ignore GO-2026-5932 by id. It is the x/crypto/openpgp advisory reaching us through go-selfupdate, and it has no fixed version (govulncheck GO-2026-5932: x/crypto/openpgp (unmaintained) linked via go-selfupdate #1163) — so the target could never pass, and a check that always fails is a check nobody runs. Any other advisory still fails the build.

On that last point, I verified the guard rather than trusting it: temporarily changing the ignored id makes make janitor exit non-zero on the very same advisory, and restoring it exits 0. (Amusing detail: my first interactive test of the grep logic gave inverted results because this shell wraps grep in a function — make uses /bin/sh, and against the real /usr/bin/grep the three cases behave as designed.)

Renovate's custom manager now watches .pre-commit-config.yaml as well as the Makefile, so both pinned versions keep updating.

Verified: make janitor exits 0, running golangci-lint (0 issues), gofumpt, gosec (0 issues) and govulncheck end to end; pre-commit run golangci-lint --all-files passes; renovate config validates against v43.

🤖 Generated with Claude Code