Hold corroborated upstream Go tool behavior from strategic queue

[laclance]

Finding

The Oct 9 private scan ranked golangci/golangci-lint#4099 as ready work. Its discussion includes an independently reproduced go vet failure and explicit evidence that cmd/go, rather than golangci-lint, causes the reported behavior. The issue is still open but does not establish a golangci-lint code fix.

Fix

• Add a deliberately narrow strategic-readiness hold only when the same comment contains upstream cmd/go attribution, an identical reproduction without the project CLI, a standalone go vet invocation, and an explicit no-project-side-fix conclusion.
• Permit an explicit trusted-maintainer implementation approval to override the hold.
• Add direct policy and full strategic rejection regressions, including partial/unsupported claims; document the readiness boundary.

This changes strategic readiness only; it does not touch paid-bounty filters, discovery, ranking, delivery, or private instance state. The prior false-positive URL is already recorded as seen, so this is a future-scan regression prevention—not a retroactive report edit.

Verification

• Base: merged dev commit 74648c5bf1001610cf57d3036dfa646e4af3775e
• Diff scoped to 5 files; CI pending.

Draft PR; do not merge without explicit authorization.