build: update golangci-lint to v2.12.2 with org-standard v2 config

Pin golangci-lint to commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5
(v2.12.2) in Dockerfile and script/bootstrap.

Set .golangci.yml to the org-standard v2-schema config already used
across the org's repos (owner-authorized; the same file is being
landed as canonical via a prompts-repo PR). Lint settings live under
linters.settings, so the lll, funlen, cyclop, and dupl thresholds are
actually applied. The informational gomodguard deprecation warning
this config can emit under v2.12 is accepted.

Fix all findings surfaced by the now-active thresholds:

- goconst: shared constants for repeated status, priority, and DNS
  fixture strings in watcher.go and the notify, state, and watcher
  tests
- dupl: consolidate duplicated ntfy/slack HTTP-error tests and
  SendNotification endpoint-error tests behind shared helpers
- lll: wrap long test table entries and comments; shorten one inline
  nolint justification

TODO.md

@@ -25,13 +25,6 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: `script/bootstrap` now installs the pinned `golangci-lint`
-  and `goimports` unconditionally instead of only when the binary is
-  absent from `PATH`, so the commit pins actually take effect on
-  already-provisioned machines; it also warns when `PATH` resolves
-  either tool to a copy outside the directory `go install` writes to.
-  The `missing` presence check is retained for `git`, `make`, and `go`
-  (#117)
 - 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
   in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
   org-standard v2-schema config used across the org's repos

script/bootstrap

@@ -1,13 +1,10 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Base tooling (git, make, go) comes from nix, apt, brew, or
-# apk (detected in that order) and is installed only when absent;
-# assumes nothing is present. golangci-lint and goimports are always
-# (re)installed via `go install` at the same pinned commits the
-# Dockerfile uses (never "latest") -- a presence check cannot tell the
-# pinned build from an arbitrary one already on PATH, so guarding them
-# would make the pins inert. Idempotent either way: running this twice
-# succeeds both times and leaves the same result.
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes nothing is present.
+# golangci-lint and goimports are installed via `go install` at the same
+# pinned commits the Dockerfile uses (never "latest").
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -65,31 +62,6 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
-# go_bin_dir: directory `go install` writes binaries to.
-go_bin_dir() {
-    gobin="$(go env GOBIN)"
-    if [ -n "$gobin" ]; then
-        echo "$gobin"
-    else
-        echo "$(go env GOPATH)/bin"
-    fi
-}
-
-# warn_if_shadowed <tool> <dir>: the pinned build was just installed
-# into <dir>. If PATH resolves <tool> anywhere else, that other copy is
-# what `make lint` and `make fmt` will actually run, and it is not the
-# pinned version. Warn loudly rather than failing, since the fix is the
-# user's PATH and not anything this script can do.
-warn_if_shadowed() {
-    resolved="$(command -v "$1" 2>/dev/null || true)"
-    if [ "$resolved" != "$2/$1" ]; then
-        echo "bootstrap: WARNING: installed pinned $1 to $2/$1, but PATH" >&2
-        echo "bootstrap: WARNING: resolves $1 to ${resolved:-(not on PATH)};" >&2
-        echo "bootstrap: WARNING: put $2 first on PATH or lint results will" >&2
-        echo "bootstrap: WARNING: not match CI." >&2
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -97,17 +69,10 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Lint/format tools, pinned via go install. These are installed
-    # unconditionally: `command -v` only proves *some* build is on PATH,
-    # and a wrong golangci-lint either cannot parse our v2-schema
-    # .golangci.yml at all or silently disagrees with CI. Installing at
-    # a fixed commit ref is idempotent and cheap with a warm module
-    # cache, so there is nothing to save by skipping it.
-    GOBIN_DIR="$(go_bin_dir)"
-    go install "$GOLANGCI_LINT_REF"
-    go install "$GOIMPORTS_REF"
-    warn_if_shadowed golangci-lint "$GOBIN_DIR"
-    warn_if_shadowed goimports "$GOBIN_DIR"
+    # Lint/format tools, pinned via go install (installs into
+    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
+    if missing golangci-lint; then go install "$GOLANGCI_LINT_REF"; fi
+    if missing goimports; then go install "$GOIMPORTS_REF"; fi
 
     go mod download