feat(talosctl): add --skip-verify flag to skip TLS certificate verification - #12652

Routine dependency bump pass with code modernization.

Go toolchain:
- go: 1.25.6 -> 1.26.2

Direct Go dependencies:
- k8s.io/{api,apimachinery,client-go}: v0.35.0 -> v0.35.3
- github.com/cosi-project/runtime: v1.13.0 -> v1.14.1
- github.com/siderolabs/crypto: v0.6.4 -> v0.6.5
- github.com/siderolabs/talos/pkg/machinery: v1.13.0-alpha.0 -> v1.13.0-beta.1
- github.com/siderolabs/talos: v1.12.2 -> v1.12.6
- github.com/spf13/cobra: v1.10.1 -> v1.10.2
- google.golang.org/grpc: v1.77.0 -> v1.80.0 (closes CVE-2026-33186)
- filippo.io/age: v1.2.1 -> v1.3.1
- github.com/BurntSushi/toml: v1.5.0 -> v1.6.0
- helm.sh/helm/v3: v3.19.5 -> v3.20.2

k8s.io indirect lockstep to v0.35.3:
- apiextensions-apiserver, apiserver, cli-runtime, component-base,
  component-helpers, kms, kubectl

Indirect security fixes:
- github.com/docker/cli: v29.1.3 -> v29.4.0 (closes CVE-2025-15558)
- github.com/cloudflare/circl: v1.6.1 -> v1.6.3 (closes CVE-2026-1229)

Round-2 bumps unblocked by Go 1.26:
- github.com/siderolabs/go-kubeconfig: v0.1.1 -> v0.1.2
- github.com/siderolabs/go-talos-support: v0.1.4 -> v0.2.0

327 additional indirect dependency updates applied across two passes via
targeted go get (each change validated with go build).

GitHub Actions:
- actions/checkout: v4 -> v6
- actions/setup-go: v5 -> v6
- goreleaser/goreleaser-action: v6 -> v7

Renovate config:
- Add .github/renovate.json with config:recommended preset and a custom
  regex manager surfacing helm.sh/helm v3 -> v4 upgrade proposals. The
  config is inert until the Renovate GitHub App is installed.

Fork replace rationale:
- Update go.mod comment to reference only siderolabs/talos#12652
  (--skip-verify, declined upstream). The previous siderolabs/talos#12644
  (--k8s-endpoint) reference is stale since #12669 was merged upstream.

Code modernization:
- gopls modernize and go fix across the codebase: interface{} -> any,
  maps.Copy, slices.Contains, gofmt cleanup. No behavior changes.

Bug fix:
- Guard initConfig() against missing os.Args[1] to prevent panic on
  plain `talm` invocation with no arguments.

Assisted-By: Claude <[email protected]>
Signed-off-by: Aleksei Sviridkin <[email protected]>

Routine dependency bump pass with code modernization.

Go toolchain:
- go: 1.25.6 -> 1.26.2

Direct Go dependencies:
- k8s.io/{api,apimachinery,client-go}: v0.35.0 -> v0.35.3
- github.com/cosi-project/runtime: v1.13.0 -> v1.14.1
- github.com/siderolabs/crypto: v0.6.4 -> v0.6.5
- github.com/siderolabs/talos/pkg/machinery: v1.13.0-alpha.0 -> v1.13.0-beta.1
- github.com/siderolabs/talos: v1.12.2 -> v1.12.6
- github.com/spf13/cobra: v1.10.1 -> v1.10.2
- google.golang.org/grpc: v1.77.0 -> v1.80.0 (closes CVE-2026-33186)
- filippo.io/age: v1.2.1 -> v1.3.1
- github.com/BurntSushi/toml: v1.5.0 -> v1.6.0
- helm.sh/helm/v3: v3.19.5 -> v3.20.2

k8s.io indirect lockstep to v0.35.3:
- apiextensions-apiserver, apiserver, cli-runtime, component-base,
  component-helpers, kms, kubectl

Indirect security fixes:
- github.com/docker/cli: v29.1.3 -> v29.4.0 (closes CVE-2025-15558)
- github.com/cloudflare/circl: v1.6.1 -> v1.6.3 (closes CVE-2026-1229)

Round-2 bumps unblocked by Go 1.26:
- github.com/siderolabs/go-kubeconfig: v0.1.1 -> v0.1.2
- github.com/siderolabs/go-talos-support: v0.1.4 -> v0.2.0

327 additional indirect dependency updates applied across two passes via
targeted go get (each change validated with go build).

GitHub Actions:
- actions/checkout: v4 -> v6
- actions/setup-go: v5 -> v6
- goreleaser/goreleaser-action: v6 -> v7

Renovate config:
- Add .github/renovate.json with config:recommended preset and a custom
  regex manager surfacing helm.sh/helm v3 -> v4 upgrade proposals. The
  config is inert until the Renovate GitHub App is installed.

Fork replace rationale:
- Update go.mod comment to reference only siderolabs/talos#12652
  (--skip-verify, declined upstream). The previous siderolabs/talos#12644
  (--k8s-endpoint) reference is stale since #12669 was merged upstream.

Code modernization:
- gopls modernize and go fix across the codebase: interface{} -> any,
  maps.Copy, slices.Contains, gofmt cleanup. No behavior changes.

Bug fix:
- Guard initConfig() against missing os.Args[1] to prevent panic on
  plain `talm` invocation with no arguments.

Assisted-By: Claude <[email protected]>

Signed-off-by: Aleksei Sviridkin <[email protected]>

Closes #153.

Adopts the `default: all` golangci-lint v2 config proposed in #153 and
reconciles the project against it: zero lint findings on both linux/amd64
(host) and windows/amd64, with a CI lint matrix gate so the strict
config doesn't erode silently.

## Strict-lint adoption

- `.golangci.yml`: `default: all` with the relaxations from the issue
  (depguard, exhaustruct, gochecknoinits, wsl, lll, errchkjson, ireturn,
  gocheckcompilerdirectives) plus three documented additions: noinlineerr
  (200+ inline if-err sites; conversion would create variable-scope
  leaks), goconst on _test.go (test fixtures live inside backtick strings;
  substitution desyncs expected vs got), gomodguard (deprecated in v2.12+,
  neither allow nor blocklist configured).
- `gomoddirectives.replace-allow-list` for github.com/siderolabs/talos and
  .../pkg/machinery — required while upstream declines siderolabs/talos#12652.

## CI lint gate

- New `lint:` job in .github/workflows/pr.yml runs golangci-lint v2.12.2
  on Ubuntu AND Windows runners (matching the existing `test:` matrix).
  Build-tagged Windows files (secureperm_windows.go, template_windows_test.go)
  are now actually evaluated on every PR instead of silently diverging.
- `.gitattributes` pins LF for *.go so Windows runners don't surface
  spurious gofmt errors from autocrlf-converted CRLF endings.

## Bug fixes surfaced by the lint pass

- pkg/commands/preflight.go: `nilerr` — two error sites swallowed errors
  with `return nil` after `if err != nil`. Now propagate.
- pkg/commands/rotate_ca_handler.go: `nosprintfhostport` — URL constructed
  via fmt.Sprintf("%s:%s", host, port) broke for IPv6 endpoints. Switched
  to net.JoinHostPort.
- pkg/age/age.go + pkg/engine/engine.go: `forcetypeassert` — type assertions
  without ok-form panicked on unexpected YAML shapes. Switched to ok-form
  with wrapped error returns.
- pkg/yamltools/yamltools.go + pkg/engine/engine.go: `exhaustive` — yaml.Kind
  switches missed DocumentNode/AliasNode/ScalarNode/SequenceNode. Added
  explicit cases with documented intent.
- pkg/commands/init.go: `writeGitignoreFile` reported "Updated" for files
  it just created (existence check ran AFTER WriteFile). Capture stat
  before write; pinned by TestContract_WriteGitignoreFile_CreatedVsUpdatedReporting.
- pkg/age/age.go: `refuseIfLeftoverBackups` (RotateKeys Phase 0) failed
  open on permission/sharing/transient I/O errors — only os.IsNotExist
  is the "no leftover" answer; everything else now fails closed.
- pkg/engine/helm/files.go: `Lines()` panicked on empty file content
  (s[len(s)-1] without length guard). Added early-return guard. Bug
  is verbatim from upstream Helm v3.20.2; we ship the code so we own
  the fix.
- pkg/commands/template.go: modeline-omitted endpoints overwrote the
  PreRunE-seeded defaultLocalEndpoint; modeline path generation
  (root-level basename fallback) was asymmetric with resolution.
  Both fixed.
- pkg/commands/root.go: dropped duplicate stderr print of modeline
  parse failures — cobra surfaces the wrapped error at the command
  boundary already.

## Refactors

- pkg/age/age.go: EncryptSecretsFile / DecryptSecretsFile / RotateKeys
  decomposed into named helpers (encryptYAMLPair, decryptYAMLPair,
  loadOrGenerateIdentity, incrementalEncryptMap, plus rotation-phase
  helpers). All 19 contract tests still pass.
- pkg/commands/apply.go + template.go: split monolithic per-file closures
  into named helpers (applyOneFileTemplateMode, applyOneFileDirectPatchMode,
  templateOneFile, buildTemplateRunner, etc.).
- pkg/engine/engine.go: extractResourceData rewritten — was an unguarded
  yamlValue.(string) assertion that would panic; now returns a typed error.

## Error-handling migration

~220 sites migrated from fmt.Errorf("...: %w", err) to cockroachdb/errors.Wrap
/ Wrapf (project standard). Adds operator-facing hints via errors.WithHint
at boundaries.

## Const hoisting

~150 repeated literals (k8s/COSI keys, Helm template names, file modes,
preset/chart names, test fixtures) moved to package-level constants with
documented intent — single source of truth, single rename per future change.

## Verification

- go build ./... — clean (host + GOOS=windows)
- go test ./... -count=1 — green (8/8 packages)
- go test ./... -race — green
- golangci-lint run — 0 issues (host + GOOS=windows)
- Manual smoke: talm init --preset cozystack --name test-cluster creates
  expected files; ancestor-project refusal works; --root . opt-in works.

Bulk of the diff is mechanical: const extraction, error-wrap migration,
blank-line discipline, and //nolint: annotations with rationale where
the rule cannot be satisfied without losing fidelity (project's
"200% rule" on disabling lints).

Assisted-By: Claude <[email protected]>
Signed-off-by: Aleksei Sviridkin <[email protected]>

Track upstream Talos v1.14.0-alpha.1 for both the main module and machinery.
This makes talm recognize new v1.14 machine-config documents (notably
KubeEtcdEncryptionConfig, siderolabs/talos#13253) which v1.13-beta machinery
rejected as "not registered".

The cozystack/talos fork (carried for the --skip-verify flag,
siderolabs/talos#12652) was pinned to a v1.13-beta base incompatible with v1.14
machinery, so it is dropped. --skip-verify is reimplemented in pkg/commands: a
package-level SkipVerify flag plus a talm-local WithClientSkipVerify that builds
an InsecureSkipVerify client from the talosconfig context (client-cert auth
preserved).

Port pkg/commands to the v1.14 talosctl client API:
- global.Args.WithClient* now take a context; the talm wrappers create a
  signal-cancellable context and pass it through.
- regenerateTalosconfig and the engine bundle path now pass a Kubernetes version
  explicitly (defaulting to the machinery default when unset), since v1.14's
  config/generate errors on an empty version instead of defaulting it.

go build, go test ./..., golangci-lint run all clean.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <[email protected]>

The fork existed solely to carry the --skip-verify flag, which upstream
declined (siderolabs/talos#12652) over the risk of leaking data to an
actor impersonating the Talos API. Reimplement the flag locally in
pkg/commands: a package-level SkipVerify bound to --skip-verify, and a
WithClientSkipVerify that opens the talosconfig, builds a TLS config
skipping server-certificate verification while preserving client-cert
authentication, and dials the node directly. With the flag no longer
depending on fork-only API, the replace directive is dropped and talm
tracks stock upstream Talos v1.13.7.

The rendered machine-config is unchanged — golden snapshots stay
byte-identical; only the client-connection path is affected.

Co-authored-by: Kirill Ilin <[email protected]>
Assisted-By: Claude <[email protected]>
Signed-off-by: Aleksei Sviridkin <[email protected]>