fix(langmgr): append +incompatible suffix for pre-module major>=2 Go deps

[omercnet]

Problem

go get fails outright when patching a pre-modules-era Go dependency released at major version 2 or higher whose module path carries no /vN suffix. The canonical case is github.com/docker/docker@v28.x: the module path is not modules-aware, so the Go toolchain only accepts the version with the +incompatible build tag. Scanner reports routinely report the bare version (v28.0.0), and the patch run dies on the go get step.

Root cause

pkg/langmgr/golang.go builds the go get spec string verbatim from the report's fixed version in two places, updateGoModule and upgradePackagesWithTooling. Both only normalize the v prefix, so a bare v28.0.0 is passed through unchanged.

Fix

New helper appendIncompatibleIfNeeded(modulePath, version) applied at both spec construction sites, right after the v-prefix normalization. It appends +incompatible only when all of the following hold:

• the version is valid semver (non-semver input is returned untouched)
• it is not already suffixed
• the major is not v0 or v1
• module.SplitPathVersion reports no path major suffix, meaning the dependency is not modules-aware

Everything else is returned unchanged, so /v2-style modules, v0/v1 deps, and pseudo-versions below v2 keep their current behavior.

Tests

• TestAppendIncompatibleIfNeeded: table-driven coverage for github.com/docker/docker@v28.0.0, /v2 path suffix, v0 and v1 majors, already-suffixed input, pseudo-versions at v0 and at v2 with and without a path suffix, and invalid/empty version input.
• TestIncompatibleVersionsPassValidation: confirms isValidGoVersion, validateGoVersion, and cleanGoVersion all accept a +incompatible version (semver treats it as build metadata, and + is not in the shell-unsafe character set).

go build ./..., go test ./pkg/langmgr, and gofumpt all pass; make lint reports only pre-existing findings unrelated to this change.

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.84%. Comparing base (2a7738b) to head (7b5b429).

Files with missing lines	Patch %	Lines
pkg/langmgr/golang.go	88.88%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1682      +/-   ##
==========================================
+ Coverage   53.74%   53.84%   +0.10%     
==========================================
  Files          69       69              
  Lines       14152    14169      +17     
==========================================
+ Hits         7606     7630      +24     
+ Misses       5802     5795       -7     
  Partials      744      744              

Files with missing lines	Coverage Δ
pkg/langmgr/golang.go	24.27% <88.88%> (+3.28%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[omercnet]

Review feedback addressed in cb82a16 (rebased on current main):

• The binary-rebuild path now builds its update map through buildBinaryUpdateMap, which applies the v prefix and appendIncompatibleIfNeeded before the versions become go.mod requirements, so it no longer records bare pre-modules v2+ requirements.
• appendIncompatibleIfNeeded now short-circuits on any existing build metadata (strings.Contains(version, "+")) rather than only a literal +incompatible suffix, so v2.0.0+build1 can never grow a second + component.
• Regression coverage: TestBuildBinaryUpdateMap and a new v2.0.0+build1 case in TestAppendIncompatibleIfNeeded.

CI: 74 of 76 checks pass. The two failures, lint and Test Bulk Patching, are inherited from main and unrelated to this diff, which only touches pkg/langmgr. Both come from integration/bulk/singlearch_patch_test.go failing typecheck after the testcontainers 0.44.0 bump (docker/docker vs moby/moby container types); the same two checks fail on main's head. #1685 fixes that, and this PR should go green once it lands.

[robert-cronin]

Both findings are resolved; could you rebase onto current main so the #1683 tests and this PR's tests are both retained and CI reruns?

[omercnet]

Rebased onto current main (2a7738b, which includes #1683) and force-pushed as 7b5b429. Note this dismissed the approval, so a re-approve is needed once CI settles.

The conflict was in pkg/langmgr/golang_test.go, where both branches appended test functions at the same spot. Both sets are retained in full: TestFilterGoDowngrades and TestGolangManagerInstallUpdatesSkipsNonNewerVersion from #1683, plus TestAppendIncompatibleIfNeeded, TestIncompatibleVersionsPassValidation and TestBuildBinaryUpdateMap from this PR. All five pass, and the diff against main is still confined to pkg/langmgr with no deletions from #1683.