Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/l7/serve.go

@@ -120,7 +120,7 @@ func Serve(ctx context.Context, conn net.Conn, peeked []byte, route RouteConfig,
 			ReadHeaderTimeout: 30 * time.Second,
 		}
 		singleConn := newSingleConnListener(tlsConn)
-		srv.Serve(singleConn)
+		_ = srv.Serve(singleConn)
 	}
 
 	return nil
@@ -213,7 +213,7 @@ func dialBackend(ctx context.Context, network, addr string, timeout time.Duratio
 		backendAddr, _ := netip.ParseAddrPort(conn.RemoteAddr().String())
 		if clientAddr.IsValid() {
 			if err := proxyproto.WriteV2(conn, clientAddr, backendAddr); err != nil {
-				conn.Close()
+				_ = conn.Close()
 				return nil, fmt.Errorf("writing PROXY protocol header: %w", err)
 			}
 		}