ci: enforce go fmt ./... in CI

.github/workflows/main.yaml

@@ -1,6 +1,20 @@
 name: Main
 on: [push, pull_request]
 jobs:
+  lint:
+    name: "Lint"
+    runs-on: ubuntu-24.04
+    steps:
+    - name: "Check out"
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - name: "Set up Go"
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+      with:
+        go-version-file: go.mod
+    - name: "golangci-lint"
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a  # v9.3.0
+      with:
+        version: v2.13.2
   test-unit:
     name: "Unit test"
     runs-on: ubuntu-24.04

.golangci.yml

@@ -0,0 +1,61 @@
+version: "2"
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+linters:
+  default: none
+  enable:
+    # TODO: fix the many unchecked errors and enable errcheck.
+    # - errcheck
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+  settings:
+    govet:
+      # TODO: fix the finding and re-enable.
+      disable:
+        - inline
+    staticcheck:
+      checks:
+        # Below is the default set
+        - "all"
+        - "-ST1000"
+        - "-ST1003"
+        - "-ST1016"
+        - "-ST1020"
+        - "-ST1021"
+        - "-ST1022"
+        # Omit embedded fields from selector expression https://staticcheck.dev/docs/checks#QF1008
+        # Usefulness is questionable; disabled permanently (as in lima/nerdctl).
+        - "-QF1008"
+        # TODO: fix the existing findings and re-enable these checks.
+        - "-S1000"   # 1 occurrence
+        - "-S1004"   # 1 occurrence
+        - "-SA4006"  # 2 occurrences
+        - "-SA4023"  # 2 occurrences
+        - "-SA6002"  # 3 occurrences
+        - "-ST1005"  # 3 occurrences
+        - "-ST1023"  # 2 occurrences; fix drops QF1011 too
+        - "-QF1011"  # 2 occurrences; duplicate of ST1023
+  exclusions:
+    rules:
+      # TODO: fix the ineffectual assignments and drop this exclusion.
+      - path: (pkg/port/builtin/child/child|pkg/port/portutil/portutil)\.go
+        linters:
+          - ineffassign
+      # TODO: remove the unused func/field and drop this exclusion.
+      - path: (pkg/network/gvisortapvsock|pkg/port/gvisortapvsock)/gvisortapvsock\.go
+        linters:
+          - unused
+
+formatters:
+  settings:
+    gofmt:
+      # Match the previous `go fmt ./...` behavior (no -s).
+      # TODO: enable simplify and fix the redundant slice literal.
+      simplify: false
+  enable:
+    - gofmt