Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/proxy/proxy_test.go

@@ -16,7 +16,7 @@ func TestRelayBasic(t *testing.T) {
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
-	defer backendLn.Close()
+	defer func() { _ = backendLn.Close() }()
 
 	peeked := []byte("peeked-hello-bytes")
 	clientData := []byte("data from client")
@@ -29,7 +29,7 @@ func TestRelayBasic(t *testing.T) {
 		if err != nil {
 			return
 		}
-		defer conn.Close()
+		defer func() { _ = conn.Close() }()
 
 		// Read everything the backend receives.
 		received, _ := io.ReadAll(conn)
@@ -40,21 +40,21 @@ func TestRelayBasic(t *testing.T) {
 	}()
 
 	// Restructure: use a more controlled flow.
-	backendLn.Close()
+	_ = backendLn.Close()
 
 	// Use a real TCP pair for proper half-close.
 	backendLn2, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
-	defer backendLn2.Close()
+	defer func() { _ = backendLn2.Close() }()
 
 	go func() {
 		conn, err := backendLn2.Accept()
 		if err != nil {
 			return
 		}
-		defer conn.Close()
+		defer func() { _ = conn.Close() }()
 
 		// Read peeked + client data.
 		buf := make([]byte, len(peeked)+len(clientData))
@@ -62,11 +62,11 @@ func TestRelayBasic(t *testing.T) {
 		backendDone <- buf[:n]
 
 		// Send response.
-		conn.Write(backendData)
+		_, _ = conn.Write(backendData)
 
 		// Close write side to signal EOF.
 		if tc, ok := conn.(*net.TCPConn); ok {
-			tc.CloseWrite()
+			_ = tc.CloseWrite()
 		}
 	}()
 
@@ -81,7 +81,7 @@ func TestRelayBasic(t *testing.T) {
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
-	defer clientLn.Close()
+	defer func() { _ = clientLn.Close() }()
 
 	clientConn, err := net.Dial("tcp", clientLn.Addr().String())
 	if err != nil {
@@ -94,9 +94,9 @@ func TestRelayBasic(t *testing.T) {
 
 	// Client sends data then closes write.
 	go func() {
-		clientConn.Write(clientData)
+		_, _ = clientConn.Write(clientData)
 		if tc, ok := clientConn.(*net.TCPConn); ok {
-			tc.CloseWrite()
+			_ = tc.CloseWrite()
 		}
 	}()
 
@@ -114,7 +114,7 @@ func TestRelayBasic(t *testing.T) {
 	}
 
 	// Verify client received backend data.
-	clientConn.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_ = clientConn.SetReadDeadline(time.Now().Add(2 * time.Second))
 	clientReceived, _ := io.ReadAll(clientConn)
 	if !bytes.Equal(clientReceived, backendData) {
 		t.Fatalf("client received %q, want %q", clientReceived, backendData)
@@ -131,12 +131,12 @@ func TestRelayBasic(t *testing.T) {
 func TestRelayIdleTimeout(t *testing.T) {
 	// Two connected pairs via TCP.
 	clientA, clientB := tcpPair(t)
-	defer clientA.Close()
-	defer clientB.Close()
+	defer func() { _ = clientA.Close() }()
+	defer func() { _ = clientB.Close() }()
 
 	backendA, backendB := tcpPair(t)
-	defer backendA.Close()
-	defer backendB.Close()
+	defer func() { _ = backendA.Close() }()
+	defer func() { _ = backendB.Close() }()
 
 	start := time.Now()
 	_, err := Relay(context.Background(), clientB, backendA, nil, 100*time.Millisecond)
@@ -154,18 +154,18 @@ func TestRelayIdleTimeout(t *testing.T) {
 
 func TestRelayContextCancel(t *testing.T) {
 	clientA, clientB := tcpPair(t)
-	defer clientA.Close()
-	defer clientB.Close()
+	defer func() { _ = clientA.Close() }()
+	defer func() { _ = clientB.Close() }()
 
 	backendA, backendB := tcpPair(t)
-	defer backendA.Close()
-	defer backendB.Close()
+	defer func() { _ = backendA.Close() }()
+	defer func() { _ = backendB.Close() }()
 
 	ctx, cancel := context.WithCancel(context.Background())
 
 	done := make(chan struct{})
 	go func() {
-		Relay(ctx, clientB, backendA, nil, time.Minute)
+		_, _ = Relay(ctx, clientB, backendA, nil, time.Minute)
 		close(done)
 	}()
 
@@ -185,12 +185,12 @@ func TestRelayContextCancel(t *testing.T) {
 
 func TestRelayLargeTransfer(t *testing.T) {
 	clientA, clientB := tcpPair(t)
-	defer clientA.Close()
-	defer clientB.Close()
+	defer func() { _ = clientA.Close() }()
+	defer func() { _ = clientB.Close() }()
 
 	backendA, backendB := tcpPair(t)
-	defer backendA.Close()
-	defer backendB.Close()
+	defer func() { _ = backendA.Close() }()
+	defer func() { _ = backendB.Close() }()
 
 	// 1 MB of random data.
 	data := make([]byte, 1<<20)
@@ -199,9 +199,9 @@ func TestRelayLargeTransfer(t *testing.T) {
 	}
 
 	go func() {
-		clientA.Write(data)
+		_, _ = clientA.Write(data)
 		if tc, ok := clientA.(*net.TCPConn); ok {
-			tc.CloseWrite()
+			_ = tc.CloseWrite()
 		}
 	}()
 
@@ -211,14 +211,14 @@ func TestRelayLargeTransfer(t *testing.T) {
 		for {
 			n, err := backendB.Read(buf)
 			if n > 0 {
-				backendB.Write(buf[:n])
+				_, _ = backendB.Write(buf[:n])
 			}
 			if err != nil {
 				break
 			}
 		}
 		if tc, ok := backendB.(*net.TCPConn); ok {
-			tc.CloseWrite()
+			_ = tc.CloseWrite()
 		}
 	}()
 
@@ -240,7 +240,7 @@ func tcpPair(t *testing.T) (net.Conn, net.Conn) {
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
-	defer ln.Close()
+	defer func() { _ = ln.Close() }()
 
 	var serverConn net.Conn
 	done := make(chan struct{})