Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/sni/sni.go

@@ -17,8 +17,8 @@ const maxBufferSize = 16384 // 16 KiB, max TLS record size
 //
 // A read deadline is set on the connection to prevent slowloris attacks.
 func Extract(conn net.Conn, deadline time.Time) (hostname string, peeked []byte, err error) {
-	conn.SetReadDeadline(deadline)
-	defer conn.SetReadDeadline(time.Time{})
+	_ = conn.SetReadDeadline(deadline)
+	defer func() { _ = conn.SetReadDeadline(time.Time{}) }()
 
 	// Read TLS record header (5 bytes).
 	header := make([]byte, 5)

internal/sni/sni_test.go

@@ -22,13 +22,13 @@ func TestExtract(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			client, server := net.Pipe()
-			defer client.Close()
-			defer server.Close()
+			defer func() { _ = client.Close() }()
+			defer func() { _ = server.Close() }()
 
 			hello := buildClientHello(tt.sni)
 
 			go func() {
-				client.Write(hello)
+				_, _ = client.Write(hello)
 			}()
 
 			hostname, peeked, err := Extract(server, time.Now().Add(5*time.Second))
@@ -53,13 +53,13 @@ func TestExtract(t *testing.T) {
 
 func TestExtractNoSNI(t *testing.T) {
 	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
 
 	hello := buildClientHelloNoSNI()
 
 	go func() {
-		client.Write(hello)
+		_, _ = client.Write(hello)
 	}()
 
 	_, _, err := Extract(server, time.Now().Add(5*time.Second))
@@ -70,11 +70,11 @@ func TestExtractNoSNI(t *testing.T) {
 
 func TestExtractNotTLS(t *testing.T) {
 	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
 
 	go func() {
-		client.Write([]byte("GET / HTTP/1.1\r\nHost: example.com\r\n\r\n"))
+		_, _ = client.Write([]byte("GET / HTTP/1.1\r\nHost: example.com\r\n\r\n"))
 	}()
 
 	_, _, err := Extract(server, time.Now().Add(5*time.Second))
@@ -85,13 +85,13 @@ func TestExtractNotTLS(t *testing.T) {
 
 func TestExtractTruncated(t *testing.T) {
 	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
 
 	go func() {
 		// Write just the TLS record header, then close.
-		client.Write([]byte{0x16, 0x03, 0x01, 0x00, 0x50})
-		client.Close()
+		_, _ = client.Write([]byte{0x16, 0x03, 0x01, 0x00, 0x50})
+		_ = client.Close()
 	}()
 
 	_, _, err := Extract(server, time.Now().Add(5*time.Second))
@@ -102,15 +102,15 @@ func TestExtractTruncated(t *testing.T) {
 
 func TestExtractOversizedRecord(t *testing.T) {
 	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
 
 	go func() {
 		// Record header claiming a length larger than 16 KiB.
 		header := []byte{0x16, 0x03, 0x01}
 		header = binary.BigEndian.AppendUint16(header, 16384) // exceeds maxBufferSize - 5
-		client.Write(header)
-		client.Close()
+		_, _ = client.Write(header)
+		_ = client.Close()
 	}()
 
 	_, _, err := Extract(server, time.Now().Add(5*time.Second))
@@ -121,13 +121,13 @@ func TestExtractOversizedRecord(t *testing.T) {
 
 func TestExtractMultipleExtensions(t *testing.T) {
 	client, server := net.Pipe()
-	defer client.Close()
-	defer server.Close()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
 
 	hello := buildClientHelloWithExtraExtensions("target.example.com")
 
 	go func() {
-		client.Write(hello)
+		_, _ = client.Write(hello)
 	}()
 
 	hostname, _, err := Extract(server, time.Now().Add(5*time.Second))