ci: scope golangci-lint to new code via new-from-merge-base

Run the full `standard` linter set but only report findings introduced since
the merge-base with master, so the legacy kernel wrapper's pre-existing issues
(unchecked defer-Close, dead helpers) don't drown the gate while new code still
gets full coverage. Fetch origin/master so the base ref is available in CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pr.yml

@@ -45,6 +45,10 @@ jobs:
       - name: go vet
         run: go vet ./...
 
+      - name: Ensure base ref is available for lint
+        # golangci-lint's new-from-merge-base needs origin/master present.
+        run: git fetch --no-tags origin master
+
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:

.golangci.yml

@@ -1,5 +1,4 @@
 # golangci-lint v2 configuration.
-# Baseline, low-noise gate for PRs. Tighten over time as the codebase is cleaned up.
 version: "2"
 
 linters:
@@ -9,3 +8,11 @@ linters:
 formatters:
   enable:
     - gofmt
+
+issues:
+  # Only report issues introduced since the merge-base with the target branch.
+  # The legacy kernel wrapper carries pre-existing findings (unchecked
+  # `defer Close()`, dead helpers) and is slated to move (#108) / be removed
+  # post-logos-delivery#3851 — gating it now would drown real signal. New code
+  # (e.g. the messaging package) gets the full linter set.
+  new-from-merge-base: origin/master