fix: repair Renovate config, convert Makefile to go run, update GitHub Actions (#120)

* fix: repair Renovate config and convert Makefile to go run (#117)

- Remove non-existent `github>renovatebot/presets:golang` preset that
  broke Renovate PR creation
- Replace deprecated `fileMatch` with `managerFilePatterns` in
  customManagers
- Rewrite regex to match new Makefile pattern (renovate comment above
  version variable assignment)
- Fix `matchFileNames` glob pattern (`*.mk` -> `**/*.mk`)
- Convert all tool invocations from `go install` + global binary to
  `go run tool@version` for reproducible builds
- Convert npm global tools to `npx --yes` invocations
- Remove `dev-deps` and `check-deps` targets (tools auto-download)
- Add mdformat pre-commit hook with GFM support and config
- Add `fmt-md` Makefile target for manual markdown formatting
- Update local golangci-lint pre-commit hook to use `go run`
- Apply golangci-lint v2.10.1 auto-fixes (fmt.Fprintf optimization)
- Add nolint:gosec annotations for legitimate exec.Command usage
- Exclude .serena/ from mdformat and megalinter
- Add markdown indent_size=unset in .editorconfig for CommonMark compat

* chore(deps): update GitHub Actions to latest versions

- anthropics/claude-code-action: v1.0.34 -> v1.0.64
- actions/setup-go: v6.2.0 -> v6.3.0
- actions/upload-artifact: v6.0.0 -> v7.0.0
- goreleaser/goreleaser-action: v6.4.0 -> v7.0.0
- docker/login-action: v3.6.0 -> v3.7.0
- ivuorinen/actions: v2026.01.21 -> v2026.02.24

* fix: address code review feedback

- Fix issue template YAML frontmatter (replace underscore separators
  with proper --- delimiters); exclude templates from mdformat
- Replace string(rune(n)) with strconv.Itoa(n) in test files to produce
  deterministic numeric directory names instead of Unicode characters
- Remove stale `make dev-deps` reference in README, replace with
  `make dev-setup`
- Extract ban/unban format strings into shared.MetricsFmtBanOperations
  and shared.MetricsFmtUnbanOperations constants
- Replace hardcoded coverage percentages in README with evergreen
  phrasing

* fix: address round 2 code review feedback for PR #120

- Fix corrupted path traversal example in docs/security.md
- Fix Renovate .mk regex to match nested paths (.*\.mk$)
- Update checkmake pre-commit hook to v0.3.2 to match Makefile
- Add sync.WaitGroup to unsynchronized goroutines in security tests
- Fix fmt-md target to use pre-commit run mdformat
- Pin markdownlint-cli2 to v0.21.0 in lint-md target
- Standardize //nolint:gosec to // #nosec annotations for gosec CLI

* fix(ci): install PyYAML dependency for PR lint workflow

The pr-lint workflow uses ivuorinen/actions/pr-lint which internally
calls validate-inputs running a Python script that imports yaml.
Python was set up but PyYAML was never installed, causing
ModuleNotFoundError at runtime.

* fix: address round 3 code review feedback for PR #120

- Wrap Windows-style path traversal example in backtick code span so
  backslashes render literally in docs/security.md
- Add Renovate-managed MARKDOWNLINT_CLI2_VERSION variable in Makefile
  to match the pattern used by all other tool versions

docs/api.md

@@ -239,14 +239,14 @@ const (
 
 The configuration system supports the following environment variables:
 
-| Variable | Description | Default |
-| -------- | ----------- | ------- |
-| `F2B_LOG_DIR` | Log directory path | `/var/log` |
-| `F2B_FILTER_DIR` | Filter directory path | `/etc/fail2ban/filter.d` |
-| `F2B_LOG_LEVEL` | Log level | `info` |
-| `F2B_COMMAND_TIMEOUT` | Command timeout | `30s` |
-| `F2B_FILE_TIMEOUT` | File operation timeout | `10s` |
-| `F2B_PARALLEL_TIMEOUT` | Parallel operation timeout | `60s` |
+| Variable               | Description                | Default                  |
+| ---------------------- | -------------------------- | ------------------------ |
+| `F2B_LOG_DIR`          | Log directory path         | `/var/log`               |
+| `F2B_FILTER_DIR`       | Filter directory path      | `/etc/fail2ban/filter.d` |
+| `F2B_LOG_LEVEL`        | Log level                  | `info`                   |
+| `F2B_COMMAND_TIMEOUT`  | Command timeout            | `30s`                    |
+| `F2B_FILE_TIMEOUT`     | File operation timeout     | `10s`                    |
+| `F2B_PARALLEL_TIMEOUT` | Parallel operation timeout | `60s`                    |
 
 ### Path Security
 
@@ -550,30 +550,30 @@ func (h *HTTPHandler) writeError(w http.ResponseWriter, code int, err error) {
 ### Error Handling Best Practices
 
 1. Always use contextual errors for user-facing messages
-2. Provide remediation hints where possible
-3. Log errors with appropriate context
-4. Use error categories for systematic handling
+1. Provide remediation hints where possible
+1. Log errors with appropriate context
+1. Use error categories for systematic handling
 
 ### Context Usage
 
 1. Always use context for operations that can timeout
-2. Propagate context through the call chain
-3. Add relevant context values for logging
-4. Use context cancellation for cleanup
+1. Propagate context through the call chain
+1. Add relevant context values for logging
+1. Use context cancellation for cleanup
 
 ### Testing
 
 1. Use the fluent testing framework for command tests
-2. Always use mock environments for integration tests
-3. Test both success and failure scenarios
-4. Include timeout testing for long-running operations
+1. Always use mock environments for integration tests
+1. Test both success and failure scenarios
+1. Include timeout testing for long-running operations
 
 ### Performance
 
 1. Use the metrics system to monitor performance
-2. Implement proper caching where appropriate
-3. Use object pooling for frequently allocated objects
-4. Profile and optimize hot paths
+1. Implement proper caching where appropriate
+1. Use object pooling for frequently allocated objects
+1. Profile and optimize hot paths
 
 This documentation provides a comprehensive overview of the f2b internal APIs and patterns.
 For specific implementation details, refer to the source code and inline documentation.