ci: enable golangci-lint with a minimal linter set

What

Request adding golangci-lint to CI with a minimal initial linter set, so we get lint signal without a large up-front cleanup. This mirrors the config that was prototyped on the v3 branch (#1130) and has now been pulled out of that PR to keep it scoped to core features.

Proposed config

.golangci.yml:

version: "2"

linters:
  default: none
  enable:
    - govet
    - ineffassign

run:
  go: "1.25"

.github/workflows/lint.yml — a lint job running golangci/golangci-lint-action (v2, e.g. version: v2.11.4) on push/PR to main and v2, with GOFLAGS: -mod=mod.

Makefile — a lint target:

.PHONY: lint
lint:
	GOFLAGS=-mod=mod golangci-lint run

Why minimal

Starting with just govet + ineffassign keeps the initial diff small and CI green, and lets us grow the enabled set incrementally rather than blocking on a big remediation pass.