fix: Resolve lint issues surfaced by Go 1.26.2 and golangci-lint v2.11.4

- Migrate proxy.Director to proxy.Rewrite (deprecated since Go 1.26)
- Use fmt.Fprintf instead of WriteString(fmt.Sprintf(...))
- Exclude noctx linter for test files (httptest.NewRequest creates a
  valid context; requiring WithContext in tests is noise)
- Remove now-unused nolint:noctx directive in bench test
- Add nolint:prealloc for defensive-copy test

Author: bjcoombs

.golangci.yml

@@ -88,6 +88,7 @@ linters:
           - err113           # Tests need dynamic errors to test error pattern matching
           - funlen           # Tests can be verbose with setup/assertions
           - cyclop           # Tests can have complex control flow
+          - noctx            # httptest.NewRequest creates a valid context; requiring WithContext in tests is noise
 
       # Allow context-as-argument after *testing.T in test helper functions
       - path: _test\.go

services/api-gateway/proxy.go

@@ -65,29 +65,29 @@ func NewProxyHandler(backends []BackendRoute) *ProxyHandler {
 		// Consider adding configurable timeout settings for production resilience:
 		// ResponseHeaderTimeout, IdleConnTimeout, MaxIdleConnsPerHost
 
-		// Configure the proxy director to add X-Forwarded-Host and identity headers.
+		// Configure the proxy rewrite to add X-Forwarded-Host and identity headers.
 		// Connect protocol headers (Content-Type, Connect-Protocol-Version, Connect-Timeout-Ms)
 		// are standard headers (not hop-by-hop) and are preserved by httputil.ReverseProxy.
-		originalDirector := proxy.Director
-		proxy.Director = func(req *http.Request) {
-			originalDirector(req)
-			// Set X-Forwarded-Host so backends know the original Host header
-			if req.Header.Get("X-Forwarded-Host") == "" {
-				req.Header.Set("X-Forwarded-Host", req.Host)
+		proxy.Rewrite = func(r *httputil.ProxyRequest) {
+			r.SetURL(target)
+			r.SetXForwarded()
+			// Preserve the original Host header for X-Forwarded-Host
+			if r.Out.Header.Get("X-Forwarded-Host") == "" {
+				r.Out.Header.Set("X-Forwarded-Host", r.In.Host)
 			}
 
 			// SECURITY: Strip any incoming identity headers to prevent spoofing.
 			// These headers are set only by the gateway after successful authentication.
-			req.Header.Del(HeaderUserID)
-			req.Header.Del(HeaderTenantID)
-			req.Header.Del(HeaderAuthMethod)
-			req.Header.Del(HeaderAuthRoles)
+			r.Out.Header.Del(HeaderUserID)
+			r.Out.Header.Del(HeaderTenantID)
+			r.Out.Header.Del(HeaderAuthMethod)
+			r.Out.Header.Del(HeaderAuthRoles)
 
 			// SECURITY: Strip X-API-Key header to prevent credential leakage to backends.
-			req.Header.Del(auth.APIKeyHeader)
+			r.Out.Header.Del(auth.APIKeyHeader)
 
 			// Add identity headers if the request was authenticated
-			addIdentityHeaders(req)
+			addIdentityHeaders(r.Out)
 		}
 
 		routes = append(routes, proxyRoute{

services/api-gateway/transcoding_bench_test.go

@@ -117,7 +117,7 @@ func startBenchEnv(b *testing.B, backends []ServiceBackend) *benchEnv {
 		AtMost(5 * time.Second).
 		PollInterval(20 * time.Millisecond).
 		Until(func() bool {
-			resp, e := http.Get(baseURL + "/health") //nolint:noctx // Health check in benchmark setup does not need request context
+			resp, e := http.Get(baseURL + "/health")
 			if e != nil {
 				return false
 			}

services/control-plane/internal/generator/handler_reference.go

@@ -48,7 +48,7 @@ func BuildHandlerReferenceCard(registry *schema.Registry) string {
 			return handlers[i].fullName < handlers[j].fullName
 		})
 
-		sb.WriteString(fmt.Sprintf("### %s\n\n", svc))
+		fmt.Fprintf(&sb, "### %s\n\n", svc)
 
 		for _, h := range handlers {
 			writeHandlerEntry(&sb, h.fullName, h.def)

services/control-plane/internal/generator/llm_client.go

@@ -212,13 +212,13 @@ func buildFixPrompt(manifest string, errors []ValidationError) string {
 	b.WriteString("## Validation Errors\n\n")
 
 	for i, e := range errors {
-		b.WriteString(fmt.Sprintf("%d. **[%s]** at `%s`\n", i+1, e.Code, e.Path))
-		b.WriteString(fmt.Sprintf("   - Message: %s\n", e.Message))
+		fmt.Fprintf(&b, "%d. **[%s]** at `%s`\n", i+1, e.Code, e.Path)
+		fmt.Fprintf(&b, "   - Message: %s\n", e.Message)
 		if e.Suggestion != "" {
-			b.WriteString(fmt.Sprintf("   - Suggestion: %s\n", e.Suggestion))
+			fmt.Fprintf(&b, "   - Suggestion: %s\n", e.Suggestion)
 		}
 		if len(e.AvailableFields) > 0 {
-			b.WriteString(fmt.Sprintf("   - Available values: %s\n", strings.Join(e.AvailableFields, ", ")))
+			fmt.Fprintf(&b, "   - Available values: %s\n", strings.Join(e.AvailableFields, ", "))
 		}
 	}
 

services/control-plane/internal/generator/topic_list.go

@@ -35,10 +35,10 @@ func BuildTopicList() string {
 		topicList := byService[svc]
 		sort.Strings(topicList)
 
-		sb.WriteString(fmt.Sprintf("### %s\n\n", svc))
+		fmt.Fprintf(&sb, "### %s\n\n", svc)
 		for _, topic := range topicList {
 			desc := describeTopicName(topic)
-			sb.WriteString(fmt.Sprintf("- `%s` — %s\n", topic, desc))
+			fmt.Fprintf(&sb, "- `%s` - %s\n", topic, desc)
 		}
 		sb.WriteString("\n")
 	}

services/position-keeping/domain/transaction_lineage_test.go

@@ -167,7 +167,7 @@ func TestTransactionLineage_DefensiveCopy_Related(t *testing.T) {
 func TestTransactionLineage_Constructor_DefensiveCopy(t *testing.T) {
 	// Test that mutating input slices after construction doesn't affect lineage
 	parentID := uuid.New()
-	children := []uuid.UUID{uuid.New(), uuid.New()}
+	children := []uuid.UUID{uuid.New(), uuid.New()} //nolint:prealloc // intentional: testing defensive copy, not building a collection
 	related := []uuid.UUID{uuid.New()}
 
 	lineage, err := NewTransactionLineage(uuid.New(), "payment", &parentID, children, related)