build: update golangci-lint to v2.12.2 with org-standard v2 config

Pin golangci-lint to commit c0d3ddc9cf3faa61a4e378e879ece580256d76e5
(v2.12.2) in Dockerfile and script/bootstrap.

Set .golangci.yml to the org-standard v2-schema config already used
across the org's repos (owner-authorized; the same file is being
landed as canonical via a prompts-repo PR). Lint settings live under
linters.settings, so the lll, funlen, cyclop, and dupl thresholds are
actually applied. The informational gomodguard deprecation warning
this config can emit under v2.12 is accepted.

Fix all findings surfaced by the now-active thresholds:

- goconst: shared constants for repeated status, priority, and DNS
  fixture strings in watcher.go and the notify, state, and watcher
  tests
- dupl: consolidate duplicated ntfy/slack HTTP-error tests and
  SendNotification endpoint-error tests behind shared helpers
- lll: wrap long test table entries and comments; shorten one inline
  nolint justification

.dockerignore

@@ -1,6 +1,5 @@
 .git/
 bin/
-.lint-cache/
 *.md
 LICENSE
 .editorconfig

.gitignore

@@ -1,7 +1,6 @@
 bin/
 vendor/
 data/
-.lint-cache/
 .env
 *.exe
 /dnswatcher

README.md

@@ -387,10 +387,7 @@ them. We provide:
 - `script/projectname` — print the project name (used for the Docker
   image tag)
 - `script/test` — run the test suite (race detector, coverage)
-- `script/lint` — run golangci-lint, with its cache and its lock file
+- `script/lint` — run golangci-lint
-  isolated to this checkout (under the git-ignored `.lint-cache/`) so
-  concurrent checkouts on one host cannot share cache entries or
-  contend on a single lock
 - `script/fmt` — format all code (gofmt -s, goimports)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check

TODO.md

@@ -25,15 +25,6 @@ confirm make check still passes.
 
 # Completed Steps
 
-- 2026-08-09: `script/lint` now isolates golangci-lint's per-user global
-  state to the checkout (#121): `GOLANGCI_LINT_CACHE` and `TMPDIR` are
-  both pointed at the git-ignored, Docker-ignored `.lint-cache/`. The
-  cache fixes cross-contamination; `TMPDIR` is what moves the lock,
-  which lives at `$TMPDIR/golangci-lint.lock` and not in the cache
-  directory. Reproduced both failure modes on the unfixed script (10 of
-  12 concurrent runs void with `parallel golangci-lint is running`; 11
-  of 12 reporting another checkout's paths) and both are gone at 20-way
-  concurrency after the fix
 - 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
   in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
   org-standard v2-schema config used across the org's repos

script/lint

@@ -1,40 +1,11 @@
 #!/bin/sh
 # script/lint: run the linter.
-#
-# golangci-lint keeps two pieces of per-user global state, and both of
-# them break when several checkouts on one host lint concurrently:
-#
-#   1. Its analysis cache (GOLANGCI_LINT_CACHE, default
-#      ~/.cache/golangci-lint). Entries are keyed by content, not by
-#      checkout, so a hit written by another checkout is replayed
-#      verbatim - including that checkout's file paths. The run then
-#      reports findings for files it never linted.
-#
-#   2. Its "one runner at a time" lock, which does NOT live in the
-#      cache directory: golangci-lint locks
-#      $(os.TempDir())/golangci-lint.lock, i.e.
-#      "$TMPDIR"/golangci-lint.lock (pkg/commands/run.go,
-#      acquireFileLock). It waits 5s, then aborts with "parallel
-#      golangci-lint is running" - a non-result that looks like a lint
-#      failure. Setting GOLANGCI_LINT_CACHE alone does not move it.
-#
-# So both are pinned under the checkout root. The cache is never shared,
-# and TMPDIR makes the lock file per-checkout, which keeps the lock
-# doing its actual job (serialising runs that share one cache) at the
-# right scope. .lint-cache/ is git-ignored and Docker-ignored, and
-# caching still works: it persists across runs in this checkout.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-
-    GOLANGCI_LINT_CACHE="$ROOT/.lint-cache/cache"
-    TMPDIR="$ROOT/.lint-cache/tmp"
-    export GOLANGCI_LINT_CACHE TMPDIR
-    mkdir -p "$GOLANGCI_LINT_CACHE" "$TMPDIR"
-
     golangci-lint run --config .golangci.yml ./...
 }