build: update golangci-lint to v2.12.2 with org-standard v2 config

Pin golangci-lint to commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5
(v2.12.2) in Dockerfile and script/bootstrap.

Set .golangci.yml to the org-standard v2-schema config already used
across the org's repos (owner-authorized; the same file is being
landed as canonical via a prompts-repo PR). Lint settings live under
linters.settings, so the lll, funlen, cyclop, and dupl thresholds are
actually applied. The informational gomodguard deprecation warning
this config can emit under v2.12 is accepted.

Fix all findings surfaced by the now-active thresholds:

- goconst: shared constants for repeated status, priority, and DNS
  fixture strings in watcher.go and the notify, state, and watcher
  tests
- dupl: consolidate duplicated ntfy/slack HTTP-error tests and
  SendNotification endpoint-error tests behind shared helpers
- lll: wrap long test table entries and comments; shorten one inline
  nolint justification

TODO.md

@@ -25,13 +25,6 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: `script/bootstrap` now installs the pinned `golangci-lint`
-  and `goimports` unconditionally instead of only when the binary is
-  absent from `PATH`, so the commit pins actually take effect on
-  already-provisioned machines; it also warns when `PATH` resolves
-  either tool to a copy outside the directory `go install` writes to.
-  The `missing` presence check is retained for `git`, `make`, and `go`
-  (#117)
 - 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
   in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
   org-standard v2-schema config used across the org's repos

script/bootstrap

@@ -1,13 +1,10 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Base tooling (git, make, go) comes from nix, apt, brew, or
+# this repo. Idempotent: every install is guarded by a check so already
-# apk (detected in that order) and is installed only when absent;
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# assumes nothing is present. golangci-lint and goimports are always
+# or apk (detected in that order); assumes nothing is present.
-# (re)installed via `go install` at the same pinned commits the
+# golangci-lint and goimports are installed via `go install` at the same
-# Dockerfile uses (never "latest") -- a presence check cannot tell the
+# pinned commits the Dockerfile uses (never "latest").
-# pinned build from an arbitrary one already on PATH, so guarding them
-# would make the pins inert. Idempotent either way: running this twice
-# succeeds both times and leaves the same result.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -65,31 +62,6 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
-# go_bin_dir: directory `go install` writes binaries to.
-go_bin_dir() {
-    gobin="$(go env GOBIN)"
-    if [ -n "$gobin" ]; then
-        echo "$gobin"
-    else
-        echo "$(go env GOPATH)/bin"
-    fi
-}
-
-# warn_if_shadowed <tool> <dir>: the pinned build was just installed
-# into <dir>. If PATH resolves <tool> anywhere else, that other copy is
-# what `make lint` and `make fmt` will actually run, and it is not the
-# pinned version. Warn loudly rather than failing, since the fix is the
-# user's PATH and not anything this script can do.
-warn_if_shadowed() {
-    resolved="$(command -v "$1" 2>/dev/null || true)"
-    if [ "$resolved" != "$2/$1" ]; then
-        echo "bootstrap: WARNING: installed pinned $1 to $2/$1, but PATH" >&2
-        echo "bootstrap: WARNING: resolves $1 to ${resolved:-(not on PATH)};" >&2
-        echo "bootstrap: WARNING: put $2 first on PATH or lint results will" >&2
-        echo "bootstrap: WARNING: not match CI." >&2
-    fi
-}
-
 main() {
     cd "$ROOT"
 
@@ -97,17 +69,10 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Lint/format tools, pinned via go install. These are installed
+    # Lint/format tools, pinned via go install (installs into
-    # unconditionally: `command -v` only proves *some* build is on PATH,
+    # "$(go env GOPATH)/bin"; ensure that is on your PATH).
-    # and a wrong golangci-lint either cannot parse our v2-schema
+    if missing golangci-lint; then go install "$GOLANGCI_LINT_REF"; fi
-    # .golangci.yml at all or silently disagrees with CI. Installing at
+    if missing goimports; then go install "$GOIMPORTS_REF"; fi
-    # a fixed commit ref is idempotent and cheap with a warm module
-    # cache, so there is nothing to save by skipping it.
-    GOBIN_DIR="$(go_bin_dir)"
-    go install "$GOLANGCI_LINT_REF"
-    go install "$GOIMPORTS_REF"
-    warn_if_shadowed golangci-lint "$GOBIN_DIR"
-    warn_if_shadowed goimports "$GOBIN_DIR"
 
     go mod download