chore(lint): add revive config and fix exhaustive switch defaults

Add revive var-naming rule with skipPackageNameChecks to suppress
package-name lint violations. Add explicit default cases to switch
statements in wireguard/intent.go for exhaustiveness. Upgrade
assert.NoError to require.NoError in firewall tests to halt on error.

.golangci.yml

@@ -42,6 +42,14 @@ linters:
     exhaustive:
       default-signifies-exhaustive: true
 
+    revive:
+      rules:
+        - name: var-naming
+          arguments:
+            - []
+            - []
+            - - skipPackageNameChecks: true
+
     staticcheck:
       checks: ["all", "-ST1005", "-S1016"]
 

cmd/firewall/allow_test.go

@@ -162,7 +162,7 @@ func TestEmitAllowRevoke_Bidirectional(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitAllowRevoke(context.Background(), inner, parent, local, fr, false)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	var posts int
 	for _, c := range fr.calls {

cmd/firewall/resolve_test.go

@@ -39,14 +39,14 @@ func TestResolveEndpoint_ByShortID(t *testing.T) {
 
 func TestResolveEndpoint_ByHostName(t *testing.T) {
 	c, err := resolveEndpoint("h3:web", cs())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, "h3", c.Host)
 	assert.Equal(t, "10.210.2.10", c.IP.String())
 }
 
 func TestResolveEndpoint_ByRawIP(t *testing.T) {
 	c, err := resolveEndpoint("10.210.1.10", cs())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, "h2", c.Host)
 }
 

internal/wireguard/intent.go

@@ -193,6 +193,8 @@ func decide(a PlannedAction, d *DesiredMesh, newHostSet map[string]struct{}) str
 		case catSafeAlways, catDestructiveReplace, catWipeDB, catCorrosionSchemaFirstWrite:
 			return "upgrade: non-version-bump action skipped"
 		}
+	default:
+		// IntentBootstrap (and unknown intents) keep every action.
 	}
 	return ""
 }
@@ -206,6 +208,7 @@ func isUpgradeServiceRestart(t ActionType) bool {
 		ActionInstallCooldService,
 		ActionInstallSchedulerService:
 		return true
+	default:
+		return false
 	}
-	return false
 }