Fixes the modernize `any` check. `any` has been an alias for
`interface{}` since Go 1.18, so this is purely lexical and does not
change the StepInputs/StepOutputs exported API.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `fmtappendf` check. fmt.Appendf appends directly
into a byte slice, avoiding the intermediate string allocation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `mapsloop` check. In ToStructPbValue this also
removes the inner loop's shadowing of the outer k/v.

Both call sites keep their explicit make(), so a nil source map still
yields an empty non-nil map.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `stringsseq` check. strings.SplitSeq and
bytes.SplitSeq yield an iterator rather than allocating a slice of all
parts up front.

In phrasestream_test.go the call is folded into the range clause, since
the intermediate `parts` variable now holds an iterator rather than the
slice its name suggests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `rangeint` check. Loops whose counter is never read
become `for range n`; the rest become `for i := range n`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `slicesbackward` check.

ValueOf's outer loop is converted to a plain range in the same commit:
the index was only used to reach envs[i].mutations, and the inner
slices.Backward rewrite depends on having the element in hand.

Lock ordering in readLockEnvChain is unchanged -- slices.Backward walks
deepest to shallowest exactly as the index loop did, and releaseLocks
still walks forward.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fixes the modernize `newexpr` check. Go 1.26 allows new() to take an
expression, which lets the compiler inline the wrapper; go.mod already
requires 1.26.0.

The //go:fix inline directive the linter suggests alongside this is
deliberately omitted -- it would have gopls/go fix rewrite every
client.Ptr call site to new(), which is a larger change than intended
for an exported helper.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

chore(lint): enable modernize linter and fix its findings

See merge request !558

They were registered before the options loop, relying on a caller's
WithBuiltinFunc for the same name to overwrite the map entry. Filling in only
unclaimed names afterwards gives the same precedence without depending on the
order of the two writes, and leaves a single place to skip them from.

Adds the coverage that pinned neither behaviour before.

An embedder hosting the runner in a long-lived process wants the orchestration
engine and nothing that reaches the network or the filesystem. Under this
option a step names a registered builtin or it is rejected.

An allowlist of one rather than a list of rejections, so a protocol added later
is rejected until someone declares it safe.

An exec function spawns a subprocess, which is the one function type that
leaves the process. Nested and builtin functions are untouched, so composition
still works.

Path is the only thing that puts a step file on disk, reached through an
output_file or export_file expression. A disabled step file errors there
instead, closing the last write path the container cannot reach.

The knob lives on GlobalContext rather than the container because the embedder
constructs it, and because every child StepsContext is built from the same one.

Ties together the pieces the container owns: no shipped builtins, only builtin
references, no exec functions. Embedders register what they want with the
existing WithBuiltinFunc.

Skipping the git fetcher also removes the container's only eager side effect,
the git cache dir. GitFetcher and CacheDir now fail rather than quietly handing
back something that would create it.

Pins the guarantee the mode exists for: a job of registered builtins leaves an
overridden TMPDIR completely empty, no files and no directories, while outputs
and exports still flow between steps.

The second test pins the failure side, so each rejection keeps naming the mode
rather than degrading into a generic unsupported-reference error.

The reference gate in resource.Parser.Parse enumerates what is permitted, so a
protocol added later is rejected until someone declares it safe. This gate was
the opposite, a denylist of one: only exec was refused, and any definition type
added to parseStepType afterwards would be allowed by default.

Hoisting the check above the switch makes both gates fail the same way.
DescribeType returns the proto enum name, so exec still reports the identical
message and the integration test asserting it passes unchanged.

Declaring it above type Container detached the DI explanation block from the
type, so godoc attributed the whole thing to an unexported error variable and
left Container undocumented.

The message also named the wrong thing at both call sites, neither of which is
a step source. Reducing it to "disabled: ..." lets the caller's prefix name
what was refused, matching how the parser and step file errors read.

GitFetcher and CacheDir fail in this mode but OCIClient, RemoteImageStore and
CachedImageStore still hand back working objects. That is not a live hole,
since ResourceParser short-circuits before it reaches them and all three
constructors only join paths, but the omission reads as an oversight in a
surface the mode describes as a boundary.

The comment sanctioned nil dependencies under WithInProcessOnly but nothing
enforced the pairing, so NewParser(nil, finder, nil) without the option
compiled and deferred the failure to a nil dereference inside NewGit or NewOCI
once a reference was loaded.

The guard compares typed pointers rather than going through
precond.MustNotBeNil, which takes an any: a nil *git.GitFetcher boxed into an
interface is not == nil, so that helper would never fire here.

TestParser_Parse_ExecAllowedByDefault built exactly the unguarded parser, so it
now opts its resource parser into the mode. The function parser under test is
deliberately left unrestricted.

TMPDIR only reaches os.TempDir on Unix; Windows consults TMP, then TEMP. The
require.Equal guard on the next line would fail the test outright rather than
skip it.

Writing the list out by hand is what makes it worth asserting against, but the
cost lands on the neighbouring subtest: a seventh default builtin would
otherwise slip past "in-process mode registers no builtins", which is the
assertion the boundary rests on.

16 of the 20 files in this directory already use the external test package and
nothing here needs unexported identifiers.

Add in-process execution mode for embedders

Closes gitlab-org/ci-cd/runner-tools/argo-rollout#22

See merge request !561