[deep-report] Fix panicinlibrarycode linter blind spot: sync.OnceValue/OnceFunc panics not exempted #48919

Description

The panicinlibrarycode analyzer (pkg/linters/panic-in-library-code/panic-in-library-code.go) only recognizes the classic sync.Once.Do(func(){...}) pattern via its isInSyncOnceDoFuncLit exemption check. It does not recognize the Go 1.21+ sync.OnceValue/sync.OnceFunc idioms, which the repo already uses in three places (pkg/workflow/engine_definition_loader.go:41, pkg/workflow/permissions_toolset_data.go:39, pkg/console/console.go:25). Two of these contain panics that currently pass linting only incidentally because their messages start with BUG: — not because the exemption logic actually recognizes the pattern. Any future sync.OnceValue initializer that panics without a BUG: prefix will silently bypass the linter despite being architecturally identical to the already-exempted case.

Expected Impact

Closes a real correctness gap in a security/quality-enforcing linter before it causes an undetected panic-in-library-code violation to ship. Prevents relying on incidental message-string matching for exemption behavior.

Suggested Agent

repository-quality-improver (already surfaced this in its 2026-07-29 report) or a general code-quality agent.

Estimated Effort

Quick (< 1 hour)

Data Source

DeepReport analysis 2026-07-29, based on discussion #48896 ("Repository Quality Improvement Report - Panic-in-Library-Code Governance Gaps").

Generated by 🔬 Deep Report · age00 · 140.4 AIC · ⌖ 7.9 AIC · ⊞ 10.8K · ◷

• expires on Jul 31, 2026, 7:33 AM UTC-08:00