Make the golangci-lint settings take effect: v2 config layout, linter pinned at v2.12.2 (closes #10)

golangci-lint v2 ignores a top-level linters-settings block without a
warning, so limits such as the 88-column line length were never
applied. .golangci.yml is now the canonical copy from sneak/prompts,
verbatim, which keeps its settings under linters.settings and also
configures depguard and gomodguard_v2. golangci-lint is pinned at
v2.12.2 by commit in the Dockerfile and script/bootstrap. The long
lines in attrsum.go are rewrapped and one nolint directive moves to
its own line; behaviour is unchanged.

Model: opus-5-5

Makefile

@@ -1,7 +1,5 @@
 .PHONY: default bootstrap setup test lint fmt fmt-check check docker hooks build clean try
 
-TESTDIR := $(HOME)/Documents/_SYSADMIN/cyberdyne
-
 # The version `make build` stamps into the binary: the git tag or short
 # commit, -dirty with uncommitted changes. `make build VERSION=x` stamps x,
 # which is how the Dockerfile passes its version in.
@@ -45,13 +43,22 @@ build: clean
 clean:
 	@rm -f attrsum
 
+# Runs the binary on three small files in a new temporary directory, which
+# the trap removes when the recipe ends, also when a step fails. The check
+# after clear is expected to fail, so its exit status is ignored.
 try: build
-	./attrsum sum add -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
-	./attrsum clear -v $(TESTDIR)
-	-./attrsum check -v $(TESTDIR)
-	./attrsum sum add -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
-	touch $(TESTDIR)/*
-	./attrsum sum update -v $(TESTDIR)
-	./attrsum check -v $(TESTDIR)
+	@set -ex; \
+	dir=$$(mktemp -d); \
+	trap 'rm -rf "$$dir"' EXIT; \
+	echo one >"$$dir/a"; \
+	echo two >"$$dir/b"; \
+	echo three >"$$dir/c"; \
+	./attrsum sum add -v "$$dir"; \
+	./attrsum check -v "$$dir"; \
+	./attrsum clear -v "$$dir"; \
+	./attrsum check -v "$$dir" || true; \
+	./attrsum sum add -v "$$dir"; \
+	./attrsum check -v "$$dir"; \
+	touch "$$dir"/*; \
+	./attrsum sum update -v "$$dir"; \
+	./attrsum check -v "$$dir"

TODO.md

@@ -20,9 +20,7 @@ have landed since the tag.
 Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
 .golangci.yml, and a comprehensive .gitignore (currently only the
 attrsum binary), and extend the Makefile (only test/build/clean/try
-today) with lint, fmt, fmt-check, check, and hooks targets. Fix the try
-target to use a temp fixture instead of the hardcoded
-$(HOME)/Documents/_SYSADMIN/cyberdyne path.
+today) with lint, fmt, fmt-check, check, and hooks targets.
 
 # Completed Steps
 
@@ -31,6 +29,9 @@ $(HOME)/Documents/_SYSADMIN/cyberdyne path.
     golangci-lint pinned at v2.12.2 in `Dockerfile` and
     `script/bootstrap`, and the code fixed for what the settings now
     report (long lines in `attrsum.go` rewrapped)
+* 2026-10-05: `make try` runs on three small files in a temporary
+    directory that it removes afterwards, also when a step fails,
+    instead of on a fixed directory on one person's machine
 * 2026-10-02: `attrsum --version` reports the git tag or short commit,
     stamped by `make build` and by a plain `docker build .` of a clone;
     `.dockerignore` sends `.git` without `.git/config` and keeps a