Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical v2-schema config: linter
  settings move under linters.settings (the previous top-level
  linters-settings block was ignored by golangci-lint v2, so the
  configured thresholds were not applied) and the obsolete
  issues.exclude-use-default key is dropped.
- Bump golangci-lint from the v2.10.1-era commit pin to @v2.12.2 in
  Dockerfile and script/bootstrap; refresh pin date comments.
- Wrap long lines in attrsum.go to satisfy the now-effective lll
  limit of 88 columns (15 findings); move one nolint:gosec directive
  to its own line.
- Record the change in TODO.md Completed Steps.

TODO.md

@@ -26,6 +26,11 @@ $(HOME)/Documents/_SYSADMIN/cyberdyne path.
 
 # Completed Steps
 
+* 2026-08-07: updated golangci-lint to v2.12.2: canonical
+    `.golangci.yml` (settings moved under `linters.settings` so the
+    configured thresholds actually apply), version pins bumped in
+    `Dockerfile` and `script/bootstrap`, and long lines wrapped to
+    satisfy the now-effective `lll` limit of 88
 * 2026-02-02: correctness pass: track actual bytes read instead of
     stale file size, atomic failure tracking in ProcessCheck, detect
     file modification during checksum (TOCTOU), propagate countFiles