Upgrade to Go 1.27 and modernize lint/CI tooling

[KARTIKrocks]

Summary

What does this PR change, and why?

Bump the go directive to 1.27 across all nine modules and go.work, apply range-over-int in analyzer/fallback.go, and repin golangci-lint to v2.13.2 (v2.12.2's bundled staticcheck panics under a Go 1.27 toolchain building IR for stdlib/vendor packages - reproduced independent of the go.mod bump).

Also fixes a golangci-lint version drift bug: ci.yml hardcoded v2.12.2 separately from the Makefile's pin. CI now resolves both golangci-lint and the new govulncheck scan from make print-*-version, mirroring wshub's pattern. Adds govulncheck (make vuln, wired into make ci) and make tidy-check, and enables errname/nilnesserr/contextcheck/fatcontext/noctx/ durationcheck/perfsprint/makezero/wastedassign/asasalint/reassign/ copyloopvar/intrange/nolintlint in .golangci.yml, fixing what they surfaced: threaded context.Context through the CLI's DB connect/ping, swapped non-formatting fmt.Errorf/fmt.Sprintf for errors.New/concatenation, dropped stale //nolint directives, and added explained //nolint markers for deliberate container/list type assertions and sqlx.DB non-context passthroughs.

Closes #

Type of change

• Bug fix
• New detection rule
• New integration / parser
• Feature / enhancement
• Docs only
• Refactor / chore

Checklist

• make ci passes (fmt-check, vet, lint, test-race) across all modules
• Added/updated tests (and, where practical, a failure-mode check)
• Updated docs as needed (README.md, AGENTS.md, .sqlguard.example.yml)
• Added an entry under ## [Unreleased] in CHANGELOG.md
• No new third-party deps in analyzer / middleware / reporter
• Findings stay redaction-safe (no raw literals leak into a Result)

Notes for reviewers

Anything reviewers should focus on — tricky areas, trade-offs, follow-ups.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a25242c9-a58e-446c-8365-f46363cfeadd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}