chore(ci): modernize GitHub Actions + migrate golangci-lint to v2 (fixes the go1.25 lint)

[kamir]

What

One PR that modernizes CI for kshark-core: bump five GitHub Actions and migrate the golangci-lint config to v2, which is the actual fix for the red Build & Test > Lint step.

Action bumps

Applied across .github/workflows/build-and-release.yml, docs.yml, security.yml (only the uses: version pins changed, no workflow restructuring):

Action	From	To	Supersedes
actions/checkout	v4	v6	#15
goreleaser/goreleaser-action	v5	v7	#13
golangci/golangci-lint-action	v6	v9	#12
actions/setup-go	v5	v6	#11
actions/deploy-pages	v4	v5	#10

These five dependabot PRs each touched the same shared workflow files and would cascade-conflict if merged one-by-one, so they are rolled into this PR. It supersedes #15, #13, #12, #11, #10.

golangci-lint v2 migration (the lint fix)

The Lint step failed on every PR with:

can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0)

go.mod targets go 1.25.0. golangci-lint v1 (last release v1.64.8, built with go1.24) refuses to lint a module that targets go1.25. golangci-lint v2 is built with go1.25 and reads a v2-format config, so the fix is both the golangci-lint-action@v9 bump above and a .golangci.yml migration from v1 to v2 format (v2 will not read the v1 config).

.golangci.yml was converted with the official migrator (golangci-lint migrate), which preserves the v1 linter intent. In v2 the default set already includes errcheck, govet, staticcheck, unused and ineffassign, so only the additional v1 linters are listed under enable. Net enabled set matches v1: errcheck, govet, staticcheck (gosimple folded in, typecheck dropped as a config entry), unused, ineffassign, misspell, gocritic, revive, plus bodyclose, gosec, noctx, and the gofmt formatter. No new linters were added and no linter was disabled wholesale.

Verified locally with golangci-lint v2.6.0 (built with go1.25.3):

• golangci-lint config verify -> valid v2 config.
• golangci-lint run ./... -> exits 0. The go1.24 < go1.25 error is gone and the config loads.

Findings handled vs deferred

The v1 lint step never ran green in CI (it always died on the go-version error), so v2 surfaced a batch of pre-existing findings on main. Handled in this PR:

• gofmt: tree-wide alignment applied (matches the go1.25 / go1.26 gofmt).
• staticcheck SA4017: fixed a real dead no-op loop in trend_test.go (a time.Before comparison whose result was discarded in an empty if body).

Deferred to a follow-up code cleanup, scoped with commented exclusions in .golangci.yml (per linter/rule, not by disabling linters):

• errcheck: unchecked io.Copy / SetReadDeadline / SetWriteDeadline / fmt.Sscanf / ReadString on probe and bundle paths, and the usual setup/teardown calls in _test.go.
• gosec: G115 (int narrowing of protocol byte fields), G401/G505 (MySQL native-password auth is sha1 by protocol), G402 (deliberate TLS probing with InsecureSkipVerify), G306 (report-file perms), G404 (jitter randomness). Inherent to a network-diagnostic probe tool.
• noctx: direct net/tls/exec calls without a context, inherent to the probe paths of a diagnostic CLI; plus _test.go.
• staticcheck style/quickfix nits: QF1002/QF1003/QF1011/QF1012/S1039/ST1005/ST1023 (tagged switch, omit inferred type, Fprintf, non-capitalized error strings).
• gocritic exitAfterDefer in CLI entrypoints.

These are tracked as a follow-up; the exclusions keep the v1 linter set enabled and let lint pass on the existing code without mass-suppression.

Verification

• golangci-lint run ./... -> 0 issues (v2 config, go1.25 toolchain).
• go build ./... -> ok.
• go vet ./... -> ok.
• go test ./... -race -> all packages pass.
• gofmt -l -> clean.