ci(golangci): drop the advisory flag + uncap max-same-issues

[LukasWodka]

The #1305 follow-up, unblocked by #427 (all 18 gosec sites waived with per-site review; uncapped local + CI runs at 0):

1. --issues-exit-code=0 removed — the job now fails on any finding, including typecheck errors (which ride the same exit path). This PR itself proves the gate: its own golangci run must pass at zero.
2. issues.max-same-issues: 0 — the default cap of 3 is how "8 findings" turned out to be 18 (10 G304s hidden behind a cache-flappy sample). A gate must see the whole backlog, every run.

After merge: mark golangci-lint required in develop branch protection (the final #1305 step — safe to require since the workflow has no paths filter and runs on every PR).

Part of tracebloc/backend#1305

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to CI/Makefile and golangci config; no application runtime or security logic is modified.

Overview
Turns golangci-lint from advisory into a real PR gate by removing --issues-exit-code=0, so any new finding (including typecheck issues on the same exit path) fails the workflow. Workflow comments are updated to document the gate and note that branch protection should mark the check required next.

Ensures the linter reports the full backlog by setting issues.max-same-issues: 0 in .golangci.yml, so repeated gosec hits are no longer truncated (which previously understated how many G304s existed).

Keeps local make ci in sync with CI: lint-full is now part of make ci, runs the same pinned golangci-lint v2.12.2 via go run (not a PATH binary), and documents version lockstep with .github/workflows/golangci.yml.

^{Reviewed by Cursor Bugbot for commit 01e5738. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (feat(data ingest): wire the 5 text tasks (#182) #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (fix(push): text preflight fails closed on a labels.csv read error #221) · author: @divyasinghds · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1326 — release-train: staging -> master · author: @LukasWodka · reviewer: @saadqbal
• backend#1328 — feat(blob_store): migrate metaApi/averaging to blob_store (#1162 PR5) · author: @saadqbal · no reviewer assigned
• backend#1330 — feat(blob_store): migrate bus_client_util.prep_experiment to blob_store (#1162 PR6) · author: @saadqbal · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

bugbut run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 01e5738. Configure here.}