LOC-justify cuts: ENI filter via slices and one shutdown drain path

[CMGS]

Cuts from the 2026-09-21 LOC-justify pass over the five K8s repos, applied after the report-only round. One commit per row, zero comment lines added, no test edited.

Commits

commit	tier	net prod	why
d7bd0cf selectReusableENIs filters through slices.DeleteFunc	1	−4	slices.DeleteFunc(slices.Clone(enis), …); the clone keeps the caller's slice intact, the [:min(len, count)] tail is unchanged
0b64250 every graceful DHCP shutdown takes the lifecycle drain	3 (fix)	−4	Run's <-ctx.Done() arm took lifecycleMu before returning, but the <-controlErrCh arm with a nil error and a canceled ctx returned without it. httpx.Run returns nil after a ctx-driven shutdown, so on SIGTERM both arms can be ready and a queued handler could start a transaction the process cannot finish. The select now folds into one tail: close the listener, cancel the run ctx, drain the control error if it is still owed, then take the drain lock on every clean exit. Error texts become control server: %w and control server: stopped unexpectedly. The linkIndex trailing comment restated the field

Net: −8 prod lines, comment lines +1/−1 (the drain comment moved with the lock).

The shutdown fold changes an edge behavior and is labelled fix:; no test drives Run (Linux-gated, real sockets), so the proof is the linux container run below plus the narrowed control flow.

Gates

• GOOS=darwin and GOOS=linux make lint: 0 issues / 0 issues each; make fmt-check clean.
• asl (commit hook, both GOOS): 0 findings.
• go test -race -count=1 ./...: 7 ok.
• linux/arm64 golang:1.27 container with --cap-add=NET_ADMIN, go build && go vet && go test -race: 7 ok on 0b64250.

Codex was not run: cut PRs go without it unless asked.