Apparently, it was never documented to use (go vet $somefile.go)
(but (go tool vet $somefile.go) was).
go 1.10 seems to do more checks within packages, and $somefile.go
is interpreted as a package with only that file (even if other files
from that package are in the same directory), leading to spurious
"undefined: $symbol" errors.
So, just run (go vet) on ./... (explicitly excluding skopeo/vendor for the
benefit of Go 1.8). We only have three subpackages, so the savings, if any,
from running (go vet) only on the modified subpackages would be small.
More importantly, on a toolchain update, ./... allows us to see the newly
detected issues all at once, instead of randomly waiting for a commit that
changes one of the affected files for the failure to show up.
Validating only committed files is not useful in the natural
$test_everything_passes; commit; push
workflow; the failures will not be caught locally, only by Travis later
(and only if PRs are used instead of direct commits to master).
So, use the working directory state instead of last commit for
validations; and remove misleading comments in checks which already use
the working directory state.
