Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/config/config.go`:
- Around line 401-410: Add a runtime validation that rejects negative values for
InjectGOMAXPROCS: in the central config validation function (where other config
fields are validated) check that InjectGOMAXPROCS >= 0 and return a clear error
(e.g., "inject_gomaxprocs must be >= 0") if it is negative so misconfiguration
is surfaced at startup rather than silently treated as disabled.

In `@test/inject_gomaxprocs.bats`:
- Around line 17-22: The fixtures in test/inject_gomaxprocs.bats use capitalized
QoS names which don't match the lowercase checks in
setupContainerEnvironmentAndWorkdir and sb.CgroupParent(); update the jq
assignments to set .linux.cgroup_parent to lowercase "burstable-pod_test.slice"
and "besteffort-pod_test.slice" (apply same change to the other
burstable/best-effort fixtures referenced) so the auto-injection and
preservation branches are exercised, and also fix the cpu_shares comment/value
mismatch by making the comment and the jq-ed value consistent (either change the
comment to 8192 or set .linux.resources.cpu_shares to 2048) so the fixture
intent matches its data.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@server/container_create.go`:
- Around line 1031-1057: The two log.Infof calls that run on every container
create (the GOMAXPROCS skip paths) should be made lower-verbosity and include
container context: change them to log.Debugf (or remove) and add identifying
fields such as the sandbox/container name and ID from the sandbox object used
here (e.g., use sb.Name() and sb.ID() or equivalent) so the messages are only
emitted at debug level and contain pod/container context; update the messages in
the branch checks that reference v2.SkipGoMaxProcs and
s.config.Workloads.IsWorkloadPartitioned accordingly.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/criocli/criocli.go`:
- Around line 1338-1343: The flag definition for the cli.Int64Flag named
"inject-gomaxprocs" currently only documents the best-effort fallback, but the
value is also used as a minimum floor for burstable pods; update the Usage
string on the "inject-gomaxprocs" flag (cli.Int64Flag) to explicitly state that
the value is used as both the fallback for best-effort pods and as the minimum
floor for burstable pods, and note that setting 0 disables injection so users
don't misconfigure it.

---

Nitpick comments:
In `@server/container_create.go`:
- Around line 1044-1055: The QoS detection should not rely on raw cgroup path
string checks on sb.CgroupParent(); replace the strings.Contains(...) gate with
a stable source or a dedicated parser: obtain the pod QoS from the pod metadata
(or add a small helper like getPodQoSFromCgroup(cgroupPath string) that
centralizes and tests path parsing) and base the branch on that QoS value before
calling calculateGOMAXPROCS and injectGOMAXPROCS; update the conditional around
sb.CgroupParent(), use the helper or pod-level QoS field, and keep
calculateGOMAXPROCS(specgen, ...) and injectGOMAXPROCS(specgen, envs,
s.ContainerServer.Config().DefaultEnv, maxProcs) calls unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@server/container_create.go`:
- Around line 1044-1053: Reshape the nested ifs in the cgroup check to be more
lint-friendly: combine the cgroupParent retrieval and contains checks into one
if (if cgroupParent := sb.CgroupParent(); strings.Contains(...) ||
strings.Contains(...)) and then inline the linux/resources checks into that
block, declaring shares and cpuQuota right where you set them from
linux.GetResources() (use a single if resources := linux.GetResources();
resources != nil { shares = resources.GetCpuShares(); cpuQuota =
resources.GetCpuQuota() }). This removes unnecessary blank lines and nesting
around sb.CgroupParent(), linux, and resources and should satisfy
golangci-lint/verify while keeping the logic for sb.CgroupParent(), linux,
resources.GetCpuShares, and resources.GetCpuQuota intact.

---

Duplicate comments:
In `@internal/criocli/criocli.go`:
- Around line 1338-1343: Update the help/usage string for the cli.Int64Flag with
Name "inject-gomaxprocs" (currently using defConf.InjectGOMAXPROCS) to mention
that this value is also used as the minimum floor for burstable pods (in
addition to being the fallback for best-effort pods), so users understand it
affects burstable pod calculation; edit the Usage text in the cli.Int64Flag
block to clearly state both behaviors and how to disable (0).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/config/workloads.go`:
- Around line 171-172: The IsWorkloadPartitioned method currently treats any
activation matched by workloadGivenActivationAnnotation as "partitioned", which
incorrectly flags non-partitioning overrides (e.g., cpuquota/cpulimit or
experimental annotations in WorkloadConfig) and suppresses GOMAXPROCS injection;
update IsWorkloadPartitioned to check the real partitioning signal instead of
the broad helper—either inspect the returned WorkloadConfig for an explicit
partitioning field/property (e.g., a Partition or IsPartition boolean) or check
for the specific partition annotation key used in your annotations map; if the
broader behavior was intended, rename workloadGivenActivationAnnotation to
reflect that it matches any activation (e.g., workloadGivenActivationOrOverride)
and add a new helper (e.g., workloadIndicatesPartitioning) that only detects the
partitioning annotation so GOMAXPROCS logic can call the narrow helper.

In `@server/container_create.go`:
- Around line 1044-1059: The current GOMAXPROCS injection decision uses CPU
resources read before NRI can mutate the spec (it reads linux.GetResources()
then calls calculateGOMAXPROCS and injectGOMAXPROCS), so change the logic to
evaluate quota/shares after the final resource mutators: either move the
skip/calculation/inject block to after s.nri.createContainer(...) or re-read the
final OCI resources from specgen (e.g., inspect specgen.Linux.Resources or call
linux.GetResources() again) immediately before calling calculateGOMAXPROCS and
injectGOMAXPROCS so the decision uses the final CPU quota/cpuset values (use
resources.GetCpuQuota()/GetCpuShares()).

---

Duplicate comments:
In `@internal/criocli/criocli.go`:
- Around line 1338-1341: The flag definition for cli.Int64Flag named
"inject-gomaxprocs" (using defConf.InjectGOMAXPROCS) has outdated usage text;
update the Usage string to state that this value is both the fallback for
best-effort pods and the minimum floor applied to burstable pods (and that 0
disables injection). Edit the Usage in the cli.Int64Flag for "inject-gomaxprocs"
to mention "minimum floor for burstable pods" alongside the best-effort fallback
and keep the "0 to disable" note.