sqldb: prevent pool access from transaction callbacks

[ziggie1984]

Change Description

Fixes #11346 by using the transaction-bound query object in
InvoicesSettledSince, avoiding a second pool connection from inside
ExecTx.

Adds the txscope analyzer to prevent transaction callbacks from accessing
their originating executor, while still allowing access to a different DB.

Steps to Test

go test ./invoices -run '^TestInvoicesSettledSinceSingleConnection$'
make lint-native

[github-actions]

🟠 PR Severity: HIGH

gh pr view | 8 files | 467 lines changed

🟠 High (1 file)

• invoices/sql_store.go - invoices/* package (invoice management and settlement)

🟡 Medium (1 file)

• .golangci.yml - repo-wide lint configuration change

🟢 Low (6 files)

• invoices/sql_store_tx_test.go - test-only change
• tools/linters/go.mod - tooling dependency module file
• tools/linters/go.sum - tooling dependency checksum file
• tools/linters/testdata/src/txscope/txscope.go - linter testdata fixture
• tools/linters/txscope.go - new custom linter implementation
• tools/linters/txscope_test.go - test-only change

Analysis

The highest-severity file is invoices/sql_store.go, a one-line change in the invoices/* package, which maps to HIGH. The bulk of the diff (302 + 102 lines) is a new custom linter (tools/linters/txscope.go and its testdata) intended to enforce transaction-scope rules, which falls under tools/* (LOW). The .golangci.yml change wires the new linter into CI and is a general repo config change (MEDIUM). No bump thresholds were met: 6 non-test/non-generated files changed (≤20) and 418 non-test lines changed (≤500), and no CRITICAL package is touched. Overall severity: HIGH, driven solely by the invoices/sql_store.go edit.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}