fix(ci): key the lint cache on the toolchain and drop the prefix fallback

[onedr0p]

Go Lint failed intermittently on a staticcheck false positive in a test that was already correct:

internal/topology/conflict_test.go:101:6: SA5011(related information): this check suggests that the pointer can be nil (staticcheck)
internal/topology/conflict_test.go:104:18: SA5011: possible nil pointer dereference (staticcheck)

t.Fatalf does terminate, but staticcheck only knows that when the testing package's facts are part of the run, and with a restored ~/.cache/golangci-lint they are not reliably there. The result is nondeterministic on byte-identical trees: on #364's branch the same restored cache key (Linux-golangci-lint-8214272e…) produced 0 issues in a 40s run (job 90625750155) and 2 issues in two 15s runs (job 90580644762, job 90653049615 — the latter blocking the merge queue).

The fix is the cache, not the test

The first pass at this reshaped the assertion, which treats the symptom. The key hashes only go.sum and .golangci.yml, so the poisoned entry survives any commit that does not touch those two files, and the bare-prefix restore-keys hands it to every subsequent run until GitHub's 7-day eviction. A different cache state simply selects a different package to fail on, and there are several other t.Fatal-then-deref sites for it to land on.

So:

• the key now covers .mise/mise.lock, so a golangci-lint or Go bump starts fresh instead of handing a new binary the old one's facts
• restore-keys is gone: a miss must start cold rather than fall back to the newest entry under the prefix, which is what let one bad entry outlive its own commit

With the input fixed, the test goes back to the file's own cond == nil || cond.Status != want idiom rather than the else branch. Both are structurally SA5011-proof, but the short-circuit form matches the other condition assertions in the package and needs no rationale comment to survive a future cleanup pass.

Also in this PR

Reviewing the surrounding code turned up four unrelated defects on the same paths.

cancelled did not fail the merge gate (Build Success). if: !cancelled() still runs that job when individual needs were cancelled but the run was not; needs.*.result then contains cancelled, not failure, so Any jobs failed? was skipped and All jobs passed or skipped? exited 0. A required job that never reached a verdict could clear branch protection.

Two Eventf calls passed an already-formatted message as the printf format string. client-go does fmt.Sprintf(note, args...), so every PoolUsageHigh warning reached operators as pool 85%!f(MISSING)ull (warn at 80%!)(MISSING) while the stored condition message was correct.

AddressConflict never set ObservedGeneration, so a stale True on a node whose address was just edited is indistinguishable from a current one. The sibling NodeGroupReconciler sets it on both of its conditions.

One node's failed status update aborted the whole conflict pass, leaving every later node unstamped and so invisible to placement. A 409 is routine here: each agent rewrites its own MiroirNode status every 60s. Per-node errors are now collected and joined, as NodeGroupReconciler already does.

The node group enqueue map func swallowed its List error, dropping the event with no requeue and no trace.

Tests

Two new (TestConflictOneBadNodeDoesNotBlockTheFleet, TestConflictConditionRecordsObservedGeneration) and three strengthened:

• TestConflictEventFiresOncePerFreshConflict ran both passes over a byte-identical fixture, so SetStatusCondition returned false and the !wasConflicted gate it exists to protect was never reached. It now adds a third node on the shared address, so pass 2 rewrites the peer list of an existing conflict.
• TestConflictSinglePassCoversAllNodes compared cond.Status == ConditionTrue as a bool, which passes on Unknown as readily as on False. It now compares the status exactly, and uses t.Errorf so a multi-node regression reports all three rather than whichever the randomized map order reached first.
• TestPoolStatsPublisherRaisesHighDataUsage drained the event channel without inspecting the note; it now asserts the note carries the condition message verbatim.

Each new assertion was checked against a reverted fix to confirm it fails.

Verified: mise run test, and golangci-lint run against a cold GOLANGCI_LINT_CACHE.

#364's branch still carries the else form of the assertion and will want the same treatment when it comes out of draft.