🐛 Fix staticcheck incompatibility with latest Go export-data format 🐛

- Dockerfile: staticcheck is now built from `honnef.co/go/tools/cmd/staticcheck@master`
  in the go-tools cross-compile stage instead of being downloaded as a tagged-release
  binary in 05-custom.sh. The latest tagged release (2026.2.1) bundles an x/tools
  importer that only reads export-data format up to version 4, but the latest Go
  release (go1.27.2) now emits version 5, so every staticcheck run failed with
  "internal error in importing ... export data version 5 is greater than maximum
  supported version 4". go-tools' master branch already has the fix (bumped its
  x/tools dependency to v0.51.0 for unified v5 export data support) but no new tag
  has shipped yet — pinned to @master as a temporary measure, documented in a comment
  to switch back to @latest once a release ships with the fix.
- rootfs/root/docker/setup/05-custom.sh: removed the now-redundant tagged-release
  staticcheck download (__gh_latest dominikh/go-tools + __install_tar), updated the
  go-install-tools comment list to include staticcheck (and the previously-missing
  go-licenses/cyclonedx-gomod).
- Verified: rebuilt the image locally (--no-cache), ran `go vet ./... && staticcheck
  ./...` against a test module inside the real container — exits 0, no export-data
  errors, against go1.27.2 and staticcheck (devel, v0.7.0-0.dev.0.20261009230814).

- README.md: N/A - no user-facing change

Claude-Session: https://claude.ai/code/session_0179kqXvwBhQiMKQkbT9XEqG

Dockerfile

@@ -37,6 +37,15 @@ FROM golang:alpine AS go-toolchain
 
 # Build Go tools natively on the host platform using Go's cross-compilation.
 # This avoids QEMU emulation for arm64 and reduces compile time from hours to minutes.
+#
+# staticcheck is pinned to @master, not @latest, as a temporary measure: the
+# latest tagged release (2026.2.1) bundles an x/tools importer that only reads
+# export-data format up to version 4, but the latest Go release now emits
+# version 5, so the tagged binary fails every run with "export data version 5
+# is greater than maximum supported version 4". go-tools' master branch
+# already has the fix (bumped its x/tools dependency to v0.51.0 for unified v5
+# export data support) but no new tag has shipped yet. Switch this back to
+# staticcheck@latest once dominikh/go-tools cuts a release containing that fix.
 FROM --platform=$BUILDPLATFORM golang:alpine AS go-tools
 ARG TARGETOS=linux
 ARG TARGETARCH
@@ -53,7 +62,8 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install golang.org/x/tools/cmd/goim
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/protobuf/cmd/protoc-gen-go@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/google/go-licenses@latest && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install honnef.co/go/tools/cmd/staticcheck@master
 
 FROM ${PULL_URL}:${DISTRO_VERSION} AS build
 ARG TZ

rootfs/root/docker/setup/05-custom.sh

@@ -156,12 +156,6 @@ __install_tar \
 curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
   | sh -s -- -b "${CUSTOM_GOBIN_DIR}" latest
 
-# staticcheck — standalone advanced static analyser (linux_amd64 / linux_arm64)
-_SC_VER="$(__gh_latest dominikh/go-tools)"
-__install_tar \
-  "https://github.com/dominikh/go-tools/releases/download/${_SC_VER}/staticcheck_linux_${_GOARCH}.tar.gz" \
-  "staticcheck"
-
 # gofumpt — stricter formatter; asset name includes version: gofumpt_v0.x.y_linux_amd64
 _GF_VER="$(__gh_latest mvdan/gofumpt)"
 __install_bin \
@@ -202,9 +196,10 @@ __install_bin \
   "goose"
 
 # go install tools (goimports, stringer, gopls, govulncheck, dlv, gops, benchstat,
-# wire, mockgen, protoc-gen-go, protoc-gen-go-grpc) are cross-compiled natively on
-# the build platform in the Dockerfile go-tools stage and copied to /usr/local/bin
-# before this script runs — no QEMU-emulated compilation needed here.
+# wire, mockgen, protoc-gen-go, protoc-gen-go-grpc, go-licenses, cyclonedx-gomod,
+# staticcheck) are cross-compiled natively on the build platform in the Dockerfile
+# go-tools stage and copied to /usr/local/bin before this script runs — no
+# QEMU-emulated compilation needed here.
 
 # Strip the module download cache and ephemeral build cache from this layer
 go clean -modcache