chore(lint): enable stricter golangci-lint config and apply fixes

[appleboy]

Summary

Fixes a batch of correctness bugs surfaced by a max-effort /code-review of the whole codebase. The headline issues are two latent index-out-of-range panics in the hitting/pitching leaderboards and a live bug where tracked Athletics players never matched because the team's API abbreviation changed from OAK to ATH.

AI Authorship

• No AI was used in this PR
• AI was used. Details:
  • Tool / model: Claude Code (Opus 4.8) via /code-review --fix
  • AI-authored files: all 7 changed files
  • Human line-by-line reviewed: none yet — please review closely before merging

Change classification

• Leaf node (local impact — each CLI command is independent; a failure crashes only that command invocation)
• Core code

What changed (by mechanism)

• Leaderboard panic (hitting.go, pitching.go): limit was taken from len(stats[0]) only, but the merge loop indexes stats[k][i] for every sort category k. Any later category returning fewer rows (or an empty 200) caused index out of range. Now bounded by the shortest column.
• Stale Athletics abbreviation (daily_hitting.go): tracked entry {"OAK","Kurtz"} never matched — the live API returns ATH (verified). Changed to ATH. This is the only user-visible behavior change.
• Standings season/date mismatch (standings.go): season was time.Now().Year() paired with an arbitrary --date, returning empty/wrong standings for cross-year queries. Season is now derived from the queried date.
• Team abbreviation typos (constant.go): HOA→HOU, OAK→ATH, SA→SD (verified against live API).
• ABS header alignment + padding (abs.go): header used fmt %-*s (rune-width) with a display-width value on CJK "比賽", misaligning columns; now uses padRight. Also guarded colorNum against a negative strings.Repeat count.
• Cleanup (daily_pitching.go, daily_hitting.go): corrected two stale comments and dropped a redundant ToLower before EqualFold.

Verification

• Existing unit tests pass (go test -count=1 ./...)
• New tests added — none (fixes are defensive/data; see Risk)
• go build, go vet, gofmt -l clean
• Live MLB API checks: team abbreviations (ATH/HOU/SD), SO/9 field equality, leaderboard row counts, and Go %-*s CJK width behavior
• Manual verification for the reviewer: run mlb daily-hitting -d <date the A's played> and confirm a tracked A's player (e.g. Kurtz) is highlighted; run mlb standings -d <past-year date> and confirm the correct season is returned.

Verifiability check

• Each fix is small and localized; inputs/outputs are documented in the diff comments
• Reviewer can judge correctness per-hunk without reading the whole codebase
• Monitoring: N/A (CLI tool, no telemetry)

Risk & rollback

• Risk: Low. The panic fixes are defensive (healthy mid-season data returns equal-length leaderboards, so they rarely triggered). The ATH change alters which tracked players are highlighted. The season/alignment fixes only affect edge cases (cross-year dates, CJK header alignment).
• Rollback: git revert 9adab3f — single self-contained commit.

Reviewer guide

• Read carefully: the leaderboard merge change in hitting.go / pitching.go (loop-bound logic) and the season derivation in standings.go.
• Spot-check OK: the abbreviation typo fixes (constant.go), comment fixes, and the ToLower removal.

Not fixed (surfaced, deferred by judgment)

• FirstLastName/ShortName mangle compound surnames ("De La Cruz"→"De") — no clean fix without a surname-particle list; better handled via a per-player override.
• Efficiency (duplicate OPS/ERA fetch, sequential leaderboard fetches), getABS/fetchAllBoxscores duplication, abbreviation-string vs team-ID matching, and several dead write-only fields — flagged in the review, left as follow-ups to avoid behavior/scope creep.

[Copilot]

Pull request overview

This PR tightens the project’s GolangCI-Lint configuration and applies a set of lint-driven refactors across CLI/util/provider code (mostly around error handling, import grouping, and small idiomatic cleanups). It also updates a number of Go module dependencies.

Changes:

• Enabled additional GolangCI-Lint linters/settings (error handling, context, shadowing, goimports formatting, etc.).
• Refactored various call sites to use errors.Is/As, %w wrapping, reduced shadowing, and small performance/idiom tweaks.
• Updated go.mod/go.sum with several direct and indirect dependency upgrades.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
util/credstore.go	Use errors.Is when handling credstore.ErrNotFound.
util/credstore_test.go	Align tests with errors.Is-based error checking.
util/api_key_helper_test.go	Avoid error variable shadowing in a test.
proxy/proxy.go	Use %w for wrapped errors in proxy setup.
provider/openai/options_test.go	Use errors.Is for error comparisons in tests.
provider/openai/func.go	Import grouping/order cleanup (goimports-compatible).
provider/gemini/gemini.go	Minor assignment style change to avoid shadowing.
provider/anthropic/anthropic.go	Avoid ranging-by-value over response content; avoid shadowing.
git/git.go	Preallocate slices, avoid string conversion for empty output, reduce shadowing.
cmd/version.go	Pass VersionInfo by pointer to avoid large-value copies.
cmd/prompt.go	Import grouping/order cleanup (goimports-compatible).
cmd/hepler.go	Import order + switch to %w in wrapped errors.
cmd/commit.go	Reduce shadowing and simplify string emptiness checks.
cmd/cmd.go	Use errors.As for viper config-not-found detection; reduce shadowing.
go.mod / go.sum	Dependency upgrades (direct + indirect).
.golangci.yml	Enable stricter linters, configure goimports/golines, tweak exclusions/settings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.