refactor: run the Go 1.27 modernizer (go fix)

[bomly-guy]

Tool

The Go 1.27 modernizer — cmd/fix, driven by go fix, from the repo's own pinned
toolchain (go 1.27.0 in go.mod):

$ go version
go version go1.27.0 darwin/arm64

On Go 1.27 go fix ./... is the modernizer and applies its rewrites in place;
go fix -diff ./... prints them instead, which is how every hunk below was read
before it was kept.

Excluded analyzers

Run exactly as:

go fix -embedlit=false -omitzero=false ./...

• embedlit flattens Coordinates: sdk.Coordinates{...} into the bare promoted
  fields at construction sites. It is behaviour-identical, so nothing mechanical
  objects — which is why the decision has to be written down. Coordinates is a named
  identity concept (ADR-0041) and the wrapper is what makes that identity visible at a
  construction site. bomly-cli and bomly-sdk both decline it; these repos agree.
  Verified here: go fix -embedlit -diff ./... is empty in this repo, so the flag is
  belt-and-braces rather than load-bearing — it stays on the command line so the next
  run cannot regress.
• omitzero rewrites omitempty to omitzero on struct-valued JSON fields. The
  encoded bytes do not move — encoding/json never omits a struct — so no test and no
  API gate objects, but the tag is the wire schema for bomly.plugin.v1, and a
  reflection-based schema consumer then reads the field as required. bomly-sdk took
  this rewrite once and spent four review rounds undoing it. Verified here: this repo
  has no field it would touch (go fix -omitzero -diff ./... is empty), so the flag is
  belt-and-braces rather than load-bearing — it stays on the command line so the next
  run cannot regress.

Changes

Analyzer	Count	Where
slicescontains	2	plugin/analyzer.go (alias scan) and plugin/parse.go (appendUnique) — a linear-scan loop becomes slices.Contains
slicesbackward	1	plugin/parse.go — the descending index loop over src.Trace becomes for _, t := range slices.Backward(src.Trace), preserving the sink→entry-point reversal the CallPath contract needs

Three hunks, all behaviour-identical.

One non-analyzer edit: the slicesbackward rewrite left a stray blank line at the top
of the loop body (gofmt does not remove it). That blank line is deleted. It is
whitespace only.

Rejected

Nothing beyond the two analyzers excluded above. Every remaining hunk was read
individually and is a mechanical rewrite with no behaviour change.

No generated file, testdata fixture, golden or frozen fixture is touched — every hunk
is in hand-written plugin/*.go.

Checks

go build ./..., go test ./..., go vet ./..., gofmt -l . (empty) and
go mod tidy -diff all pass locally. The FuzzParseGovulncheckJSON target was also run for
10s against the rewritten parser and passes.

🤖 Generated with Claude Code