ci(lint): centralize nolint patterns (#499)

[trilamsr]

Summary

Centralize the remaining structural nolint patterns into .golangci.yml path-scoped exclude-rules. Builds on PR #507 (lane A: _test.go G304) by covering the next four structural classes that were each generating multiple inline waivers.

Inline nolint: waivers: 35 → 13 (-63%). Untouched: module/processor/patterndetectorprocessor/ (lane J overlap; deferred to next wave) and 11 point-specific load-bearing keepers.

Before / after by category

Category	Before	After	Mechanism
gosec (G304 in _test.go)	8	0	already covered by PR #507's existing exclude-rule (redundant comments)
gosec (G204 / G107 integration tests)	3	0	new path scope internal/integration/.*_test\.go, components/.*/integration_helper_test\.go
gosec (G304 hermetic replay loader)	3	0	new path scope module/pkg/replay/runner\.go
gosec (G304 jsonschematest helper)	1	0	new path scope module/pkg/testutil/jsonschematest/.*\.go
gosec (G306 / G304 / G404 dev tools)	5	0	new path scopes for tools/genfixtures, tools/coverage-check, tools/failure-inject
goconst (patterns test vocabularies)	2	0	new path scope module/pkg/patterns/.*_test\.go
Centralized subtotal	22	0
gocyclo (kept inline, load-bearing)	7	7	flat-table dispatch / pattern-match rationale; point-specific
gosec (G103 / G304 prod, load-bearing)	2	2	xid_correlation.go unsafe aliasing; nccl_fr.go operator-config path
unused (doc / export refs)	2	2	pyspy.go, steady_state_linux_test.go — referenced from doc.go
wrapcheck (stutter rationale)	1	1	tools/coverage-check/main.go os.Open already includes path
staticcheck (SA1019 parity assert)	1	1	xid_correlation_test.go — issue #277 pre-deprecation parity
Inline keepers subtotal	13	13
TOTAL inline	35	13	-22 (-63%)

Root cause

Each inline waiver was treating a class of safe-by-design call sites as a point exception. The class-level fixes (path-scoped exclude-rules) move the rationale into one searchable location so future reviewers grep .golangci.yml instead of git log-archaeologying 22 scattered comments.

What's NOT in this PR

• module/processor/patterndetectorprocessor/config.go (2 gocyclo waivers) and xid_correlation_test.go (1 staticcheck) — lane J (test: synthetic-2026-06-multi-rank-disk-pressure fixture mis-labelled as negative #497) touches patterndetectorprocessor/; deferred to the next wave to avoid merge conflicts.
• The 11 load-bearing inline keepers above — each carries a point-specific rationale that does not generalize to a path scope (unsafe aliasing site, weak-RNG-for-chaos-repro, pre-deprecation parity asserts, etc.).

Test plan

• make lint green pre-change (baseline: 0 issues).
• make lint green post-change (0 issues).
• Pre-commit hook ran root golangci-lint + module/ golangci-lint + go vet + go mod verify + attribute-namespace-check — all green.
• git diff --stat confirms no patterndetectorprocessor/ files touched.

Closes #499.

ci(lint): centralize 22 inline `nolint` waivers (gosec G204/G107/G304/G306/G404, goconst) into `.golangci.yml` path-scoped exclude-rules. 13 load-bearing point-specific waivers remain inline.