Apply managed DNS mode in the macOS package

cmd/cli/service.go

@@ -162,6 +162,11 @@ func (s *systemd) Start() error {
 // This is necessary for running self-upgrade flow.
 func ensureSystemdKillMode(r io.Reader) (opts []*unit.UnitOption, change bool) {
 	opts, err := unit.DeserializeOptions(r)
+	// staticcheck sees only the explicit non-nil sends on the lexer's error
+	// channel, so it reports this comparison as always true. On success the
+	// lexer sends nothing and closes the channel, so the receive yields a nil
+	// error and this branch is not taken.
+	//lint:ignore SA4023 upstream delivers a nil error by closing the channel
 	if err != nil {
 		mainLog.Load().Error().Err(err).Msg("failed to deserialize options")
 		return