Update golangci-lint to v2.12.2 with canonical config

Add the canonical .golangci.yml (v2 layout, default: all with the
standard disable list) and pin golangci-lint v2.12.2 in the Makefile
deps target using the v2 module path, replacing the @latest install on
the old v1 path. The Dockerfile lint stage already pinned the v2.12.2
alpine image by digest and is unchanged.

Fix all issues surfaced by the strict config:

- err113: introduce wrapped static sentinel errors
- gocognit/funlen/nestif: split ExtractDay, Run, DumpAndCompress,
  VerifyOutput, and the CLI flag parsing into smaller helpers
- noctx: use ExecContext/QueryContext/BeginTx and CommandContext
- noinlineerr: replace inline if-err assignments with plain ones
- wsl_v5/nlreturn: add required blank lines
- lll: wrap long lines and SQL strings
- gosec: filepath.Clean on file open/create; bounded uint64
  conversion in CheckFreeSpace; named output dir permission constant
- mnd: use unix.FADV_* constants and named size constants
- revive: add package and exported symbol comments
- testpackage/paralleltest: move smoke test to bsdaily_test with
  t.Parallel()
- nonamedreturns: drop non-error named returns

The remaining nolint directives (gosec subprocess launches with
internal paths, unqueryvet full-row SELECT * copies whose schema is
defined by the source database) are each justified inline.

.golangci.yml

@@ -0,0 +1,34 @@
+version: "2"
+
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
+run:
+  timeout: 5m
+  modules-download-mode: readonly
+
+linters:
+  default: all
+  disable:
+    # Genuinely incompatible with project patterns
+    - exhaustruct      # Requires all struct fields
+    - depguard         # Dependency allow/block lists
+    - godot            # Requires comments to end with periods
+    - wsl              # Deprecated, replaced by wsl_v5
+    - wrapcheck        # Too verbose for internal packages
+    - varnamelen       # Short names like db, id are idiomatic Go
+  settings:
+    lll:
+      line-length: 88
+    funlen:
+      lines: 80
+      statements: 50
+    cyclop:
+      max-complexity: 15
+    dupl:
+      threshold: 100
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0