Update golangci-lint to v2.12.2 with canonical config

Add the canonical .golangci.yml (v2 layout, default: all with the
standard disable list) and pin golangci-lint v2.12.2 in the Makefile
deps target using the v2 module path, replacing the @latest install on
the old v1 path. The Dockerfile lint stage already pinned the v2.12.2
alpine image by digest and is unchanged.

Fix all issues surfaced by the strict config:

- err113: introduce wrapped static sentinel errors
- gocognit/funlen/nestif: split ExtractDay, Run, DumpAndCompress,
  VerifyOutput, and the CLI flag parsing into smaller helpers
- noctx: use ExecContext/QueryContext/BeginTx and CommandContext
- noinlineerr: replace inline if-err assignments with plain ones
- wsl_v5/nlreturn: add required blank lines
- lll: wrap long lines and SQL strings
- gosec: filepath.Clean on file open/create; bounded uint64
  conversion in CheckFreeSpace; named output dir permission constant
- mnd: use unix.FADV_* constants and named size constants
- revive: add package and exported symbol comments
- testpackage/paralleltest: move smoke test to bsdaily_test with
  t.Parallel()
- nonamedreturns: drop non-error named returns

The remaining nolint directives (gosec subprocess launches with
internal paths, unqueryvet full-row SELECT * copies whose schema is
defined by the source database) are each justified inline.

Makefile

@@ -46,7 +46,7 @@ clean:
 # Install dependencies.
 deps:
 	go mod download
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
 
 # Run tests with coverage.
 test-coverage: