fix(lint): resolve gofmt and SA4023 failures from golangci-lint v2.13.1

The golangci-lint pin moved to v2.13.1 in #2351, which surfaced four
pre-existing issues that fail the merge gate on main:

- pkg/diff/topology_test.go: Go 1.27 gofmt reindents the multi-value
  composite-literal return in collidingCluster().
- tools/testgrid-publish/main.go: SA4023 flags the err != nil guard in
  extractSigner() as always true, because readPointerFromAttestation is
  a documented stub that unconditionally returns ErrCodeInternal. The
  guard is the contract for the real implementation (#1267), so it is
  suppressed rather than removed.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

pkg/diff/topology_test.go

@@ -87,13 +87,13 @@ func refLabelItem(key, value, dataKey string, count int) measurement.ItemEntry {
 // the vintages — the count as well as the presence of items.
 func collidingCluster() (map[string]string, []measurement.ItemEntry) {
 	return map[string]string{
-			"zone.us-west": "true|gpu-a,gpu-b",
-			"zone.us-east": "us-east|gpu-b",
-		}, []measurement.ItemEntry{
-			labelItem("zone", "us-east", "gpu-b"),
-			labelItem("zone", "us-west", "gpu-a"),
-			labelItem("zone.us-west", "true", "gpu-a,gpu-b"),
-		}
+		"zone.us-west": "true|gpu-a,gpu-b",
+		"zone.us-east": "us-east|gpu-b",
+	}, []measurement.ItemEntry{
+		labelItem("zone", "us-east", "gpu-b"),
+		labelItem("zone", "us-west", "gpu-a"),
+		labelItem("zone.us-west", "true", "gpu-a,gpu-b"),
+	}
 }
 
 // TestSnapshots_UpgradeIsNotDrift pins that capturing a baseline with an older

tools/testgrid-publish/main.go

@@ -309,8 +309,8 @@ func resultString(passed bool) string {
 // extractSigner reads signer identity and issuer from the bundle's
 // attestation.intoto.jsonl if present; returns empty strings otherwise.
 func extractSigner(bundleDir string) (identity, issuer string) {
-	pointer, err := readPointerFromAttestation(bundleDir)
-	if err != nil || pointer == nil || len(pointer.Attestations) == 0 {
+	pointer, err := readPointerFromAttestation(bundleDir)               //nolint:staticcheck // SA4023: stub always errors today; see readPointerFromAttestation
+	if err != nil || pointer == nil || len(pointer.Attestations) == 0 { //nolint:staticcheck // SA4023: guard is the contract for the real implementation (#1267)
 		return "", ""
 	}
 	att := pointer.Attestations[0]
@@ -350,6 +350,6 @@ func printDryRun(bucket, prefix string, started startedJSON, finished finishedJS
 // attestation.AttestationFilename. Tracking issue: NVIDIA/aicr#1267.
 // When implemented, parse failures must NOT be swallowed the same way —
 // only a genuinely absent attestation file should fall back to empty strings.
-func readPointerFromAttestation(_ string) (*attestation.Pointer, error) {
+func readPointerFromAttestation(_ string) (*attestation.Pointer, error) { //nolint:staticcheck // SA4023: unconditional error is the stub's documented behavior until #1267 lands
 	return nil, errors.New(errors.ErrCodeInternal, "signer extraction not yet implemented")
 }