chore: stabilize lint tooling

[marcus]

Summary

• add a checked-in .golangci.yml with the repo Go version and a small set of passing core linters
• pin local and CI golangci-lint usage, plus add explicit fmt, vet, lint-install, and expanded check make targets
• keep the pre-commit hook fast and document the fast-hook path versus full lint verification in the README

Validation

• gofmt -l $(rg --files -g '*.go')
• go vet ./...
• golangci-lint run ./...
• go test ./...
• make lint-install
• make fmt
• make vet
• make lint
• make check

[marcus]

Follow-up for review feedback:

• switched make fmt from rg to git ls-files so format checks do not depend on ripgrep
• resolved make lint via the pinned Go-bin install path when golangci-lint is not on PATH
• hardened both targets to use toolchain binaries from go env GOROOT, which also keeps the checks working under a stripped PATH
• clarified the README so make lint-install -> make check matches the actual local workflow

Validation run on this update:

• make lint-install
• make fmt
• make vet
• go test ./...
• make lint
• make check
• PATH="/usr/bin:/bin" /usr/bin/make fmt GO=/opt/homebrew/bin/go
• PATH="/usr/bin:/bin" /usr/bin/make lint GO=/opt/homebrew/bin/go