chore: address remaining CS-007 mutable package-level variable violations

[sonupreetam]

Context

While fixing GroupOrder in internal/doctor/doctor.go as part of PR #722 review feedback (@em-redhat observation), we audited all package-level var declarations in the codebase against Go convention pack CS-007:

CS-007 [MUST] Avoid mutable package-level variables. No global mutable state. Prefer functional style and dependency injection.

Two items were fixed in PR #722:

• GroupOrder — converted from var []CheckGroup to func GroupOrder() []CheckGroup
• datetimeLayouts — inlined into its sole caller parseDatetime()

Remaining violation

deprecationWarned in internal/complytime/config.go

var (
    deprecationWarned   = make(map[string]bool)
    deprecationWarnedMu sync.Mutex
)

This is the most genuine CS-007 violation in the codebase — actual mutable global state with a mutex, used to deduplicate @version deprecation warnings across ParsePolicyRef calls within a process lifetime.

Options:

1. Move the dedup map into a receiver struct (e.g., a ConfigLoader or Parser type) passed via dependency injection
2. Accept as a pragmatic exception — the dedup map prevents log spam and has no functional side effects; document as an intentional deviation

Items audited and cleared

The following package-level vars were reviewed and determined to not violate CS-007:

Variable	File	Reason
envVarPattern, unsafeRefChars, validBundleName, validPathComponent	various	Compiled *regexp.Regexp — effectively immutable; standard Go idiom
ErrVersionNotFound	internal/registry/client.go	Sentinel error — standard Go idiom
versionTemplate	internal/version/version.go	string — immutable in Go
commit, buildDate, version, gitTreeState	internal/version/version.go	ldflags-injected build vars — unavoidable
Handshake	pkg/provider/plugin.go	Struct value passed by value to go-plugin API; no mutation
hclogCharmLevels	pkg/log/log.go	Read-only map lookup table; borderline but near-zero risk
SupportedProviders	pkg/provider/plugin.go	Constrained by go-plugin API contract requiring map[string]goplugin.Plugin

Priority

Low — the remaining violation (deprecationWarned) is functionally harmless and internal. Filed for tracking and future cleanup.