chore: drop the temporary vuln-scan acceptance list now Go is current

Makefile

@@ -412,7 +412,7 @@ fix:
 
 govulncheck:
 	@echo "Running govulncheck..."
-	$(_Q)scripts/run-gate.sh govulncheck scripts/govulncheck-gate.sh
+	$(_Q)scripts/run-gate.sh govulncheck go tool govulncheck ./...
 	@echo "  govulncheck ok"
 
 # NilAway — advisory nil-panic analysis. Not in preflight due to false positives

govulncheck-accepted.txt

@@ -1,3 +0,0 @@
-# Reachable vulnerabilities accepted for a bounded time, read by scripts/govulncheck-gate.sh.
-# Format: <OSV-ID> <expiry YYYY-MM-DD> <reason>
-# The gate fails once the expiry passes: fix the dependency or renew deliberately.

scripts/govulncheck-gate.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# Fails on any reachable vulnerability that is not listed in
-# govulncheck-accepted.txt, and on any acceptance whose expiry has passed.
-# Each line is "<OSV-ID> <YYYY-MM-DD expiry> <reason>"; '#' starts a comment.
-# GOVULNCHECK_JSON substitutes a saved -format json report, for tests.
-set -euo pipefail
-
-accepted_file=${GOVULNCHECK_ACCEPTED:-govulncheck-accepted.txt}
-today=${GOVULNCHECK_TODAY:-$(date -u +%F)}
-
-if [ -n "${GOVULNCHECK_JSON:-}" ]; then
-	report=$(cat "$GOVULNCHECK_JSON")
-else
-	report=$(go tool govulncheck -format json ./...)
-fi
-
-# A finding whose first trace frame names a function is reachable from our
-# code; text mode reports only these, so module- and package-level ones pass.
-mapfile -t called < <(printf '%s\n' "$report" | jq -rs \
-	'[.[] | select(.finding) | .finding | select(.trace[0].function) | .osv] | unique | .[]')
-
-declare -A expiry reason
-if [ -f "$accepted_file" ]; then
-	while read -r id until why; do
-		[[ -z "$id" || "$id" == \#* ]] && continue
-		expiry[$id]=$until
-		reason[$id]=$why
-	done <"$accepted_file"
-fi
-
-fail=0
-for id in "${called[@]}"; do
-	if [ -z "${expiry[$id]:-}" ]; then
-		echo "  $id is reachable and not accepted; run 'go tool govulncheck ./...' for the trace"
-		fail=1
-	elif [[ "$today" > "${expiry[$id]}" ]]; then
-		echo "  $id acceptance expired on ${expiry[$id]}: ${reason[$id]}"
-		fail=1
-	else
-		echo "  $id accepted until ${expiry[$id]}: ${reason[$id]}"
-	fi
-done
-
-for id in "${!expiry[@]}"; do
-	if ! printf '%s\n' "${called[@]}" | grep -qx "$id"; then
-		echo "  $id is accepted but no longer reported; remove it from $accepted_file"
-	fi
-done
-
-exit "$fail"

scripts/govulncheck-gate_test.sh

@@ -1,53 +0,0 @@
-#!/bin/sh
-# Tests the accepted-vulnerability gate against saved reports, so the logic is
-# checked without running the scanner.
-set -u
-
-here=$(cd "$(dirname "$0")" && pwd)
-gate="$here/govulncheck-gate.sh"
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-cat >"$tmp/accepted.txt" <<'EOF'
-# comment
-GO-2026-6597 2026-11-07 accepted for the test
-EOF
-cat >"$tmp/reachable.json" <<'EOF'
-{"config":{}}
-{"finding":{"osv":"GO-2026-6597","trace":[{"module":"m","package":"p","function":"Pull"}]}}
-{"finding":{"osv":"GO-2026-0001","trace":[{"module":"m"}]}}
-EOF
-cat >"$tmp/new.json" <<'EOF'
-{"finding":{"osv":"GO-2026-6597","trace":[{"module":"m","package":"p","function":"Pull"}]}}
-{"finding":{"osv":"GO-2026-7777","trace":[{"module":"m","package":"p","function":"F"}]}}
-EOF
-echo '{"config":{}}' >"$tmp/clean.json"
-
-fails=0
-check() {
-	want=$1 name=$2 report=$3 today=$4 accepted=$5 expect=$6
-	out=$(GOVULNCHECK_JSON="$tmp/$report" GOVULNCHECK_TODAY=$today GOVULNCHECK_ACCEPTED=$accepted bash "$gate" 2>&1)
-	rc=$?
-	if [ "$rc" != "$want" ] || ! printf '%s' "$out" | grep -q "$expect"; then
-		echo "FAIL [$name] rc=$rc want=$want output: $out"
-		fails=$((fails + 1))
-	else
-		echo "ok   [$name]"
-	fi
-}
-
-check 0 "accepted reachable finding passes" reachable.json 2026-10-07 "$tmp/accepted.txt" "GO-2026-6597 accepted until 2026-11-07"
-check 0 "expiry day itself still passes" reachable.json 2026-11-07 "$tmp/accepted.txt" "accepted until"
-check 1 "expired acceptance fails" reachable.json 2026-11-08 "$tmp/accepted.txt" "acceptance expired on 2026-11-07"
-check 1 "new reachable finding fails" new.json 2026-10-07 "$tmp/accepted.txt" "GO-2026-7777 is reachable and not accepted"
-out=$(GOVULNCHECK_JSON="$tmp/reachable.json" GOVULNCHECK_TODAY=2026-10-07 GOVULNCHECK_ACCEPTED="$tmp/accepted.txt" bash "$gate" 2>&1)
-if printf '%s' "$out" | grep -q "GO-2026-0001"; then
-	echo "FAIL [module-level finding is not reachable] output: $out"
-	fails=$((fails + 1))
-else
-	echo "ok   [module-level finding is not reachable]"
-fi
-check 0 "fixed finding warns that acceptance is stale" clean.json 2026-10-07 "$tmp/accepted.txt" "no longer reported"
-check 1 "missing acceptance file fails reachable finding" reachable.json 2026-10-07 "$tmp/none" "not accepted"
-
-[ "$fails" -eq 0 ] || exit 1