Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/grpcserver/grpcserver.go

@@ -53,7 +53,7 @@ func New(cfg config.GRPC, srv *server.Server, store *db.Store, logger *slog.Logg
 	path := cfg.SocketPath()
 
 	// Remove stale socket file from a previous run.
-	os.Remove(path)
+	_ = os.Remove(path)
 
 	ln, err := net.Listen("unix", path)
 	if err != nil {
@@ -61,7 +61,7 @@ func New(cfg config.GRPC, srv *server.Server, store *db.Store, logger *slog.Logg
 	}
 
 	if err := os.Chmod(path, 0600); err != nil {
-		ln.Close()
+		_ = ln.Close()
 		return nil, nil, fmt.Errorf("setting socket permissions: %w", err)
 	}
 
@@ -446,7 +446,7 @@ func (a *AdminServer) GetStatus(_ context.Context, _ *pb.GetStatusRequest) (*pb.
 		}
 		listeners = append(listeners, &pb.ListenerStatus{
 			Addr:              ls.Addr,
-			RouteCount:        int32(len(routes)),
+			RouteCount:        int32(len(routes)), //nolint:gosec // route count can never exceed int32
 			ActiveConnections: ls.ActiveConnections.Load(),
 			ProxyProtocol:     ls.ProxyProtocol,
 			MaxConnections:    ls.MaxConnections,