chore: Go 1.27 toolchain, lint fixes, go fix modernization (#800)

## Description

Full Go 1.27 update in four commits:

1. **Toolchain go1.26.6 → go1.27.0** — CI resolves its Go version from
`go.mod` via the shared `netresearch/.github` go-check workflow. Also
bumps the two Makefile `GOTOOLCHAIN` pins for the golangci-lint install,
and corrects the prerequisite in `docs/DEVELOPMENT.md` and
`CONTRIBUTING.md` from "Go 1.25+" to "Go 1.26+" (the `go` directive has
required 1.26 already).
2. **Lint fixes under the 1.27 toolchain** — gofumpt's new closing-paren
placement in one test file, and removal of six `//nolint:goconst`
directives that nolintlint now reports as unused (goconst no longer
fires there; all annotated literals sit below the config's
`min-occurrences: 6`, and `.golangci.yml` is untouched by this PR).
3. **`go fix` modernization** across 14 files — `strings.Cut` (2 sites),
`slices.Backward` (RemoveJobsByTag), `maps.Copy`, `errors.AsType[T]` (3
sites), `atomic.Int32` migrations in six test files, and inlining of the
`durationPtr`/`uint64Ptr` test helpers to `new(expr)` with the
now-unused helpers removed.
4. **Review-round comment fix** — the `slices.Backward` removal in
RemoveJobsByTag is safe because of the `break` after the removal (the
range form captures the slice header once); the comment now says so
instead of describing the old index loop.

The `go` directive stays at 1.26.

## Testing

`go build ./...`, `go vet ./...`, `golangci-lint run` (0 issues) and `go
test -race ./...` (14 packages, all pass) under go1.27.0; `go mod tidy`
is a no-op. An independent review agent proved the `slices.Backward`
rewrite equivalent for all inputs (including duplicate cron IDs),
verified the goconst occurrence counts against the config, and found no
weakened assertions.

The advisory SonarCloud check is red on new-code duplication (5.3% vs
3%) — the mechanical `atomic.Int32` test rewrites count as "new code";
not in the required-checks ruleset.

_Assisted by claude-code:claude-fable-5 —
[Session](https://claude.ai/code/session_01L7tF9XuJfAfFk4yuY5KfPK)_

Author: CybotTM

CONTRIBUTING.md

@@ -53,7 +53,7 @@ The project's lefthook `commit-msg` hook validates the presence of
 
 ### Prerequisites
 
-- Go 1.25 or higher
+- Go 1.26 or higher
 - Docker (for integration and E2E tests)
 - Docker Swarm enabled (for service job tests)
 

Makefile

@@ -54,14 +54,14 @@ tidy:
 .PHONY: lint
 lint:
 	@mkdir -p $(BUILD_PATH)/.tools
-	@GOTOOLCHAIN=go1.26.5 GOBIN=$(BUILD_PATH)/.tools go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+	@GOTOOLCHAIN=go1.27.0 GOBIN=$(BUILD_PATH)/.tools go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 	@$(BUILD_PATH)/.tools/golangci-lint version || true
 	@$(BUILD_PATH)/.tools/golangci-lint run --timeout=5m
 
 .PHONY: lint-fix
 lint-fix:
 	@mkdir -p $(BUILD_PATH)/.tools
-	@GOTOOLCHAIN=go1.26.5 GOBIN=$(BUILD_PATH)/.tools go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+	@GOTOOLCHAIN=go1.27.0 GOBIN=$(BUILD_PATH)/.tools go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 	@$(BUILD_PATH)/.tools/golangci-lint run --fix --timeout=5m
 
 .PHONY: lint-full

cli/config_decode.go

@@ -168,7 +168,7 @@ func mapstructureKeyForField(field reflect.StructField) string {
 		return ""
 	}
 	if tag != "" {
-		if name := strings.SplitN(tag, ",", 2)[0]; name != "" && name != "-" {
+		if name, _, _ := strings.Cut(tag, ","); name != "" && name != "-" {
 			return name
 		}
 	}

cli/config_drift_test.go

@@ -76,7 +76,7 @@ func assertDocumented(t *testing.T, docs string, f reflect.StructField, containe
 	if tag == "" {
 		return
 	}
-	name := strings.SplitN(tag, ",", 2)[0]
+	name, _, _ := strings.Cut(tag, ",")
 	if name == "" || name == "-" {
 		return // squash on the embed itself, or explicitly ignored
 	}

cli/config_webhook.go

@@ -405,7 +405,7 @@ func applyWebhookLabelParams(config *middlewares.WebhookConfig, params map[strin
 			config.Preset = val
 		case "id":
 			config.ID = val
-		case "secret": //nolint:goconst // matches gcfg:"secret" struct tag — Go syntax requires literal in tag
+		case "secret":
 			config.Secret = val
 		case "url":
 			config.URL = val

cli/docker-labels.go

@@ -527,7 +527,7 @@ func (c *Config) filterGlobalLabelKey(key, value, containerName string, globalCo
 
 func hasServiceLabel(labels map[string]string) bool {
 	for k, v := range labels {
-		if k == serviceLabel && v == "true" { //nolint:goconst // Docker labels are stringly-typed — value is the literal "true"
+		if k == serviceLabel && v == "true" {
 			return true
 		}
 	}

cli/doctor_docker_timeout_test.go

@@ -86,9 +86,13 @@ func (h *hangingDoctorProvider) InspectExec(_ context.Context, _ string) (*domai
 func (h *hangingDoctorProvider) RunExec(_ context.Context, _ string, _ *domain.ExecConfig, _, _ io.Writer) (int, error) {
 	return 0, nil
 }
-func (h *hangingDoctorProvider) PullImage(_ context.Context, _ string) error           { return nil }
+
+func (h *hangingDoctorProvider) PullImage(_ context.Context, _ string) error { return nil }
+
 func (h *hangingDoctorProvider) EnsureImage(_ context.Context, _ string, _ bool) error { return nil }
-func (h *hangingDoctorProvider) ConnectNetwork(_ context.Context, _, _ string) error   { return nil }
+
+func (h *hangingDoctorProvider) ConnectNetwork(_ context.Context, _, _ string) error { return nil }
+
 func (h *hangingDoctorProvider) FindNetworkByName(_ context.Context, _ string) ([]domain.Network, error) {
 	return nil, nil
 }

config/validator.go

@@ -387,11 +387,11 @@ func (cv *Validator2) validateSpecificStringField(v *Validator, path string, str
 	switch fieldKey(path) {
 	case keySchedule, "cron":
 		cv.validateCronField(v, path, str)
-	case "email-to", "email-from": //nolint:goconst // see comment above switch
+	case "email-to", "email-from":
 		cv.validateEmailField(v, path, str)
 	case "web-address", "pprof-address":
 		cv.validateAddressField(v, path, str)
-	case "log-level": //nolint:goconst // see comment above switch
+	case "log-level":
 		cv.validateLogLevelField(v, path, str)
 	case keyCommand, "cmd":
 		cv.validateCommandField(v, path, str)

core/adapters/docker/service_convert_test.go

@@ -110,9 +110,9 @@ func TestConvertToSwarmSpec(t *testing.T) {
 					ContainerSpec: domain.ContainerSpec{Image: "nginx"},
 					RestartPolicy: &domain.ServiceRestartPolicy{
 						Condition:   domain.RestartConditionOnFailure,
-						Delay:       durationPtr(5 * time.Second),
-						MaxAttempts: uint64Ptr(3),
-						Window:      durationPtr(2 * time.Minute),
+						Delay:       new(5 * time.Second),
+						MaxAttempts: new(uint64(3)),
+						Window:      new(2 * time.Minute),
 					},
 				},
 			},
@@ -219,7 +219,7 @@ func TestConvertToSwarmSpec(t *testing.T) {
 					ContainerSpec: domain.ContainerSpec{Image: "nginx"},
 				},
 				Mode: domain.ServiceMode{
-					Replicated: &domain.ReplicatedService{Replicas: uint64Ptr(3)},
+					Replicated: &domain.ReplicatedService{Replicas: new(uint64(3))},
 				},
 			},
 			validate: func(t *testing.T, result swarm.ServiceSpec) {
@@ -451,11 +451,3 @@ func TestConvertFromSwarmTask(t *testing.T) {
 }
 
 // --- Helper functions ---
-
-func durationPtr(d time.Duration) *time.Duration {
-	return &d
-}
-
-func uint64Ptr(v uint64) *uint64 {
-	return &v
-}

core/adapters/docker/service_roundtrip_test.go

@@ -166,9 +166,9 @@ func TestServiceSpec_RoundTrip_RestartPolicy(t *testing.T) {
 			},
 			RestartPolicy: &domain.ServiceRestartPolicy{
 				Condition:   domain.RestartConditionOnFailure,
-				Delay:       durationPtr(10 * time.Second),
-				MaxAttempts: uint64Ptr(5),
-				Window:      durationPtr(3 * time.Minute),
+				Delay:       new(10 * time.Second),
+				MaxAttempts: new(uint64(5)),
+				Window:      new(3 * time.Minute),
 			},
 		},
 	}
@@ -251,7 +251,7 @@ func TestServiceSpec_RoundTrip_ModeReplicated(t *testing.T) {
 		},
 		Mode: domain.ServiceMode{
 			Replicated: &domain.ReplicatedService{
-				Replicas: uint64Ptr(3),
+				Replicas: new(uint64(3)),
 			},
 		},
 	}