deps: remove xerrors in favor of stdlib fmt/errors

[kotakanbe]

Why (motivation for removing this dependency)

• golang.org/x/xerrors was the error handling library used before Go 1.13 added %w wrapping to fmt.Errorf and errors.Is/errors.As to the stdlib
• Since the project uses Go 1.26, all xerrors functionality has stdlib equivalents
• xerrors remains as an indirect dependency (pulled in by upstream modules), but removing it as a direct dependency improves go.mod hygiene and code standardization
• 788 usages across 72 files — the largest single-dependency removal in this diet project

What (replacement details)

• Mechanical replacement: xerrors.Errorf → fmt.Errorf, xerrors.New → errors.New
• []error wrapping fix: 8 call sites passed []error slices to %w (which xerrors silently accepted). These now use errors.Join(errs...) for proper multi-error wrapping
• Bug fix: detector/vuls2/db.go passed session.SchemaVersion (a function value) to %d format verb — fixed to use the result variable sv
• Lint fix: 8 errors.New / fmt.Errorf strings that were capitalized or ended with punctuation — lowercased to satisfy revive linter (xerrors was exempt from this rule)

Changed files (72 .go files + go.mod)

File	Change
64 files across config/, detector/, scanner/, reporter/, gost/, etc.	xerrors.Errorf → fmt.Errorf, xerrors.New → errors.New, import cleanup
detector/kevuln.go, detector/msf.go, detector/cti.go, detector/cve_client.go, detector/exploitdb.go, gost/util.go, scanner/debian.go	%w with []error → errors.Join(errs...)
scanner/redhatbase.go, scanner/suse.go	%w with non-error execResult → %v
detector/vuls2/db.go	Fix: session.SchemaVersion (func) → sv (int) in format string
config/portscan.go, scanner/base.go	Lowercase error strings for revive compliance
go.mod	xerrors demoted from direct to indirect

Safety (why this is safe)

• Risk level: near-zero
• fmt.Errorf with %w is the official stdlib replacement for xerrors.Errorf since Go 1.13
• errors.New is the direct stdlib equivalent of xerrors.New
• errors.Join properly wraps []error slices (improvement over xerrors which silently stringified them)
• No special xerrors features used (no xerrors.Is, xerrors.As, xerrors.Formatter, xerrors.Frame)

Test plan

• go build ./cmd/... — pass
• go test ./... — 15 packages pass
• GOEXPERIMENT=jsonv2 golangci-lint run ./... — 0 issues

Review hint (how to review efficiently)

1. Start with go.mod — confirms xerrors moved to indirect
2. Skim any 2-3 files (e.g. detector/detector.go, scanner/base.go) — verify the mechanical pattern is consistent
3. Focus review on: detector/vuls2/db.go (bug fix), the 7 errors.Join call sites, and config/portscan.go (lowercased error strings)
4. Skip: The remaining ~64 files are import-deletion + xerrors.Xxx → fmt/errors.Xxx with no logic changes

🤖 Generated with Claude Code