build: update Go to 1.27.1 and modernize the codebase (#2798)

Toolchain and CI:
- Bump go directive from 1.26.8 to 1.27.1 (go.mod)
- Use golang:1.27-alpine builder images in all Dockerfiles
- Bump golangci-lint to v2.13.2 (first release with go1.27 support)
- Add CI gate: `go fix -diff` fails when outdated Go patterns are
  detected (locally: `make check-modernize`)

Note: darwin binaries now require macOS 13 or later.

Lint fixes required by golangci-lint v2.13.2:
- goconst: ignore tests (all 436 findings were test-only; goconst
  got stricter since v2.12 and this option was added for it)
- openai.go: keep deprecated MaxTokens deliberately with a nolint
  rationale (max_tokens is the only form universally supported by
  OpenAI-compatible backends like One-API, LiteLLM, Ollama shim)
- state.go: drop always-nil flags param from appendChartVersionFlags
  (renamed to chartVersionFlags, unparam)

Modernization (go fix ./..., 62 files):
- interface{} -> any, maps.Copy, strings.SplitSeq, range-over-int,
  builtin min/max, slices.Contains/ContainsFunc/Sort, WaitGroup.Go,
  reflect.Type.Fields(), new(expr)
- exit_error.go: strings.Builder + fmt.Fprintf instead of string
  concatenation and WriteString(fmt.Sprintf(...)) (QF1012)
- chart_dependency.go: strings.CutLast for OCI dependency helpers

Signed-off-by: yxxhero <aiopsclub@163.com>
Co-authored-by: Claude <noreply@anthropic.com>

pkg/helmexec/exec.go

@@ -306,14 +306,8 @@ func (helm *execer) retryRepoOp(name string, op func() ([]byte, error)) ([]byte,
 		}
 		// Cap the shift exponent at 5 (2^5 = 32x already exceeds the 30x cap)
 		// so very large --repo-retries values can't overflow time.Duration.
-		shift := attempt
-		if shift > 5 {
-			shift = 5
-		}
-		backoff := repoRetryBaseBackoff * time.Duration(1<<shift)
-		if backoff > 30*repoRetryBaseBackoff {
-			backoff = 30 * repoRetryBaseBackoff
-		}
+		shift := min(attempt, 5)
+		backoff := min(repoRetryBaseBackoff*time.Duration(1<<shift), 30*repoRetryBaseBackoff)
 		helm.logger.Warnf("repo operation %q failed (%s); retry %d/%d in %v",
 			name, conciseError(err), attempt+1, maxRetries, backoff)
 		// sleepCtx returns false if interrupted by context cancellation; in that
@@ -329,8 +323,7 @@ func (helm *execer) retryRepoOp(name string, op func() ([]byte, error)) ([]byte,
 // reports just the exit status, avoiding the very verbose PATH/ARGS/OUTPUT
 // dump that Error() produces.
 func conciseError(err error) string {
-	var ee ExitError
-	if errors.As(err, &ee) {
+	if ee, ok := errors.AsType[ExitError](err); ok {
 		return fmt.Sprintf("exit status %d", ee.ExitStatus())
 	}
 	return err.Error()
@@ -515,8 +508,7 @@ func getSupportedDependencyFlags() map[string]bool {
 		// Get global flags from Helm 3 cli.EnvSettings
 		envSettings := cliv3.New()
 		envType := reflect.TypeOf(*envSettings)
-		for i := 0; i < envType.NumField(); i++ {
-			field := envType.Field(i)
+		for field := range envType.Fields() {
 			if field.IsExported() {
 				flagName := "--" + toKebabCase(field.Name)
 				supported[flagName] = true
@@ -529,8 +521,7 @@ func getSupportedDependencyFlags() map[string]bool {
 		// Get dependency-specific flags from Helm 3 action.Dependency
 		dep := actionv3.NewDependency()
 		depType := reflect.TypeOf(*dep)
-		for i := 0; i < depType.NumField(); i++ {
-			field := depType.Field(i)
+		for field := range depType.Fields() {
 			if field.IsExported() {
 				flagName := "--" + toKebabCase(field.Name)
 				supported[flagName] = true
@@ -540,8 +531,7 @@ func getSupportedDependencyFlags() map[string]bool {
 		// Get global flags from Helm 4 cli.EnvSettings
 		envSettings := cliv4.New()
 		envType := reflect.TypeOf(*envSettings)
-		for i := 0; i < envType.NumField(); i++ {
-			field := envType.Field(i)
+		for field := range envType.Fields() {
 			if field.IsExported() {
 				flagName := "--" + toKebabCase(field.Name)
 				supported[flagName] = true
@@ -554,8 +544,7 @@ func getSupportedDependencyFlags() map[string]bool {
 		// Get dependency-specific flags from Helm 4 action.Dependency
 		dep := actionv4.NewDependency()
 		depType := reflect.TypeOf(*dep)
-		for i := 0; i < depType.NumField(); i++ {
-			field := depType.Field(i)
+		for field := range depType.Fields() {
 			if field.IsExported() {
 				flagName := "--" + toKebabCase(field.Name)
 				supported[flagName] = true
@@ -589,8 +578,8 @@ func filterDependencyUnsupportedFlags(flags []string) []string {
 	for _, flag := range flags {
 		// Extract flag name without value (e.g., "--dry-run=server" -> "--dry-run")
 		flagName := flag
-		if idx := strings.Index(flag, "="); idx != -1 {
-			flagName = flag[:idx]
+		if before, _, ok := strings.Cut(flag, "="); ok {
+			flagName = before
 		}
 
 		// Check if this flag or any prefix of it is supported
@@ -841,8 +830,8 @@ func (helm *execer) TemplateRelease(name string, chart string, flags ...string)
 				i++
 				continue
 			}
-			if strings.HasPrefix(flags[i], "--output-dir=") {
-				outputDir = strings.TrimPrefix(flags[i], "--output-dir=")
+			if after, ok := strings.CutPrefix(flags[i], "--output-dir="); ok {
+				outputDir = after
 				continue
 			}
 			filteredFlags = append(filteredFlags, flags[i])