fix: repair Renovate config, convert Makefile to go run, update GitHub Actions (#120)

* fix: repair Renovate config and convert Makefile to go run (#117)

- Remove non-existent `github>renovatebot/presets:golang` preset that
  broke Renovate PR creation
- Replace deprecated `fileMatch` with `managerFilePatterns` in
  customManagers
- Rewrite regex to match new Makefile pattern (renovate comment above
  version variable assignment)
- Fix `matchFileNames` glob pattern (`*.mk` -> `**/*.mk`)
- Convert all tool invocations from `go install` + global binary to
  `go run tool@version` for reproducible builds
- Convert npm global tools to `npx --yes` invocations
- Remove `dev-deps` and `check-deps` targets (tools auto-download)
- Add mdformat pre-commit hook with GFM support and config
- Add `fmt-md` Makefile target for manual markdown formatting
- Update local golangci-lint pre-commit hook to use `go run`
- Apply golangci-lint v2.10.1 auto-fixes (fmt.Fprintf optimization)
- Add nolint:gosec annotations for legitimate exec.Command usage
- Exclude .serena/ from mdformat and megalinter
- Add markdown indent_size=unset in .editorconfig for CommonMark compat

* chore(deps): update GitHub Actions to latest versions

- anthropics/claude-code-action: v1.0.34 -> v1.0.64
- actions/setup-go: v6.2.0 -> v6.3.0
- actions/upload-artifact: v6.0.0 -> v7.0.0
- goreleaser/goreleaser-action: v6.4.0 -> v7.0.0
- docker/login-action: v3.6.0 -> v3.7.0
- ivuorinen/actions: v2026.01.21 -> v2026.02.24

* fix: address code review feedback

- Fix issue template YAML frontmatter (replace underscore separators
  with proper --- delimiters); exclude templates from mdformat
- Replace string(rune(n)) with strconv.Itoa(n) in test files to produce
  deterministic numeric directory names instead of Unicode characters
- Remove stale `make dev-deps` reference in README, replace with
  `make dev-setup`
- Extract ban/unban format strings into shared.MetricsFmtBanOperations
  and shared.MetricsFmtUnbanOperations constants
- Replace hardcoded coverage percentages in README with evergreen
  phrasing

* fix: address round 2 code review feedback for PR #120

- Fix corrupted path traversal example in docs/security.md
- Fix Renovate .mk regex to match nested paths (.*\.mk$)
- Update checkmake pre-commit hook to v0.3.2 to match Makefile
- Add sync.WaitGroup to unsynchronized goroutines in security tests
- Fix fmt-md target to use pre-commit run mdformat
- Pin markdownlint-cli2 to v0.21.0 in lint-md target
- Standardize //nolint:gosec to // #nosec annotations for gosec CLI

* fix(ci): install PyYAML dependency for PR lint workflow

The pr-lint workflow uses ivuorinen/actions/pr-lint which internally
calls validate-inputs running a Python script that imports yaml.
Python was set up but PyYAML was never installed, causing
ModuleNotFoundError at runtime.

* fix: address round 3 code review feedback for PR #120

- Wrap Windows-style path traversal example in backtick code span so
  backslashes render literally in docs/security.md
- Add Renovate-managed MARKDOWNLINT_CLI2_VERSION variable in Makefile
  to match the pattern used by all other tool versions

docs/architecture.md

@@ -35,17 +35,21 @@ validation caching, and parallel processing capabilities for enterprise-grade re
 ### fail2ban/ Package
 
 - **Purpose**: Core business logic and system interaction
+
 - **Key Interfaces**:
+
   - `Client`: Main interface for fail2ban operations with context support
   - `Runner`: Command execution interface
   - `SudoChecker`: Privilege validation interface
 
 - **Implementations**:
+
   - `RealClient`: Production fail2ban client with timeout handling
   - `MockClient`: Comprehensive test double with thread-safe operations
   - `NoOpClient`: Safe fallback implementation
 
 - **Advanced Features**:
+
   - Context-aware operations with timeout and cancellation support
   - Validation caching system with thread-safe operations
   - Optimized ban record parsing with object pooling
@@ -105,14 +109,14 @@ validation caching, and parallel processing capabilities for enterprise-grade re
 ### Command Execution Flow
 
 1. **CLI Parsing**: Cobra processes command-line arguments
-2. **Context Creation**: Create context with timeout for operation
-3. **Validation**: Input validation with caching and sanitization
-4. **Privilege Check**: Determine if sudo is required
-5. **Metrics Start**: Begin performance metrics collection
-6. **Business Logic**: Execute fail2ban operations via Client interface with context
-7. **Parallel Processing**: Use parallel workers for multi-jail operations
-8. **Metrics End**: Record operation timing and success/failure
-9. **Output**: Format and display results (plain or JSON)
+1. **Context Creation**: Create context with timeout for operation
+1. **Validation**: Input validation with caching and sanitization
+1. **Privilege Check**: Determine if sudo is required
+1. **Metrics Start**: Begin performance metrics collection
+1. **Business Logic**: Execute fail2ban operations via Client interface with context
+1. **Parallel Processing**: Use parallel workers for multi-jail operations
+1. **Metrics End**: Record operation timing and success/failure
+1. **Output**: Format and display results (plain or JSON)
 
 ### Dependency Flow
 
@@ -170,25 +174,25 @@ fail2ban/client.go
 ### Adding New Commands
 
 1. Create new file in `cmd/` package
-2. Implement command using established patterns with context support
-3. Use dependency injection for testability
-4. Add performance metrics collection
-5. Implement fluent testing framework patterns
-6. Add comprehensive tests with mocks and context-aware operations
+1. Implement command using established patterns with context support
+1. Use dependency injection for testability
+1. Add performance metrics collection
+1. Implement fluent testing framework patterns
+1. Add comprehensive tests with mocks and context-aware operations
 
 ### Adding New Backends
 
 1. Implement the `Client` interface
-2. Add any new required interfaces (Runner, etc.)
-3. Update main.go to support new backend
-4. Add configuration options
+1. Add any new required interfaces (Runner, etc.)
+1. Update main.go to support new backend
+1. Add configuration options
 
 ### Adding New Output Formats
 
 1. Extend output formatting helpers
-2. Update command implementations
-3. Add format validation
-4. Test with existing commands
+1. Update command implementations
+1. Add format validation
+1. Test with existing commands
 
 ## Testing Architecture