task lint fails on macOS: staticcheck SA4023 in execution executor non-Linux stub #2101

Bug description

task lint fails on macOS on a clean main. golangci-lint (staticcheck SA4023) reports three issues in code introduced by #1614. CI lints only on ubuntu-24.04, so it doesn't catch this. Contributors working on macOS can't pass the task lint gate that AGENTS.md requires before a PR is ready.

Steps to reproduce

1. On macOS, check out main (tested at f8b2d7f5).
2. Run task lint.

Expected behavior

task lint passes on macOS as it does on Linux.

Actual behavior

cmd/mecatl-executor/main.go:37:63: SA4023: this comparison is always true (staticcheck)
	} else if err := executionexecutor.EnableCommandExecution(); err != nil {
internal/executionexecutor/executor.go:179:2: SA4023(related information): the lhs of the comparison is the 3rd return value of this function call (staticcheck)
	result, cleanupProven, err := runIsolatedCommand(runCtx, e.workspace.Root(), q.Command, e.limits.MaxFileBytes)
internal/executionexecutor/executor.go:188:12: SA4023: this comparison is always true (staticcheck)
	} else if err != nil || result.exitCode != 0 {
3 issues:
* staticcheck: 3

GOOS=linux task lint on the same checkout reports 0 issues in every module.

Cause

On non-Linux builds, internal/executionexecutor/command_unsupported.go (//go:build !linux) supplies stubs. Both EnableCommandExecution and runIsolatedCommand always return a non-nil error. staticcheck analyzes the darwin build, sees that the error is never nil, and flags the err != nil checks as always true. The production code is correct. The finding comes from the platform stub.

Possible fixes

• Add //nolint:staticcheck with a short reason at the two comparisons, noting that the error is constant only in the non-Linux stub.
• Or exclude SA4023 for these paths in .golangci.yml.
• Or restructure the stub so its errors aren't provably constant to the analyzer. For example, return a package-level error variable through a function staticcheck can't fold.

Optional: run a lint leg on a macOS runner, or run the existing lint with GOOS=darwin, so this class of platform-only finding is caught in CI.

Environment (if relevant)

• OS/version: macOS 26.6.2 (Darwin 25.6.0, arm64)
• mecatl version or commit: f8b2d7f5 (main)
• golangci-lint: v2.13.1 (pinned, via scripts/install-golangci-lint.sh)
• Go: go1.27.1
• Deployment shape: not applicable (developer tooling)