Update golangci-lint to v2.12.2 with canonical config

Add the canonical .golangci.yml (v2 layout, default: all with the
standard disable list) and pin golangci-lint v2.12.2 in the Makefile
deps target using the v2 module path, replacing the @latest install on
the old v1 path. The Dockerfile lint stage already pinned the v2.12.2
alpine image by digest and is unchanged.

Fix all issues surfaced by the strict config:

- err113: introduce wrapped static sentinel errors
- gocognit/funlen/nestif: split ExtractDay, Run, DumpAndCompress,
  VerifyOutput, and the CLI flag parsing into smaller helpers
- noctx: use ExecContext/QueryContext/BeginTx and CommandContext
- noinlineerr: replace inline if-err assignments with plain ones
- wsl_v5/nlreturn: add required blank lines
- lll: wrap long lines and SQL strings
- gosec: filepath.Clean on file open/create; bounded uint64
  conversion in CheckFreeSpace; named output dir permission constant
- mnd: use unix.FADV_* constants and named size constants
- revive: add package and exported symbol comments
- testpackage/paralleltest: move smoke test to bsdaily_test with
  t.Parallel()
- nonamedreturns: drop non-error named returns

The remaining nolint directives (gosec subprocess launches with
internal paths, unqueryvet full-row SELECT * copies whose schema is
defined by the source database) are each justified inline.

TODO.md

@@ -20,6 +20,10 @@ green with the new lint config.
 
 # Completed Steps
 
+- 2026-08-07: Added canonical `.golangci.yml`; pinned golangci-lint
+  v2.12.2 in the `Makefile` `deps` target (v2 module path, replacing
+  `@latest` on the old v1 path); fixed all lint issues surfaced by the
+  strict config across `cmd/bsdaily` and `internal/bsdaily`.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-06-28: Fixed errcheck lint failures; added compilation smoke test;