Update golangci-lint to v2.12.2 with canonical config (closes #60)

- Add canonical .golangci.yml (v2 schema, default: all, project
  thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
  (go install, new /v2 module path) and Dockerfile (tagged+digest
  Debian image pin)
- Fix all lint findings surfaced by the new linter set across
  cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
  static sentinel errors (err113), context-aware HTTP and exec
  (noctx), guarded integer conversions and stricter permissions
  (gosec), named constants (mnd, goconst), function decomposition
  (funlen, cyclop, gocognit, nestif), declaration ordering
  (funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
  (paralleltest, usetesting), protobuf getters (protogetter), plus
  formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
  testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
  not cross-wire the process-global logger's captured output

The decompositions are behavior-preserving. In particular:

- REPO_POLICIES.md is untouched and stays byte-identical to the
  authoritative copy in the prompts repo
- the mfer.manifest type stays unexported; whether to export it is an
  open owner design question (README question 13)
- directories created by fetch keep mode 0755, because fetched trees
  are content meant to be readable by other uids
- an absent MFFilePath.Mtime is handled explicitly and identically in
  freshen, list, and export rather than being read as the Unix epoch,
  which would classify every entry as changed and rewrite the manifest
  on every freshen
- every user-visible error message renders byte-identically to what it
  did before, with the err113 sentinels wrapped mid-sentence where
  needed; the rendered strings are now pinned by tests

Also fixes an argument-injection defect the lint pass surfaced: key IDs
reach gpg as bare positional arguments, so a key ID beginning with "-"
was parsed by gpg as an option. All positional arguments now follow an
explicit "--" end-of-options marker.

The symlink-escape gap in fetch's path handling, which sanitizePath
does not and cannot address, is filed separately as #86.

TODO.md

@@ -16,13 +16,19 @@ in flight and unmerged.
 
 # Next Step
 
-Land the in-flight compliance branch chore/align-repo-policies: finish and
-commit the uncommitted work (32 modified Go files, new untracked
-.golangci.yml and TODO.md), confirm `make check` is green, merge the branch
-(one commit ahead of main as of 2026-07-03) to main, and push.
+Work through the remaining compliance items folded from the 2026-07-02
+audit (the first group under Future Steps): `.editorconfig`, `.gitignore`
+coverage, gofumpt-based `fmt-check`, README "Getting Started", and the
+rest. `.golangci.yml` and `TODO.md` are tracked and committed as of
+2026-08-07, so the only thing left of the `chore/align-repo-policies`
+branch is the list below.
 
 # Completed Steps
 
+- 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned
+  (`Makefile`, `Dockerfile`), added the canonical `.golangci.yml`
+  (`default: all`), and fixed all resulting lint findings across the
+  codebase
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-07-03: aligned repo tooling, docs, and config with standardized
@@ -45,8 +51,6 @@ commit the uncommitted work (32 modified Go files, new untracked
 - Compliance (fold of TODO.md audit 2026-07-02; verify which items the
   in-flight branch already closes, then check off):
   - Add .editorconfig (canonical copy from sneak/prompts)
-  - Add standardized .golangci.yml (present untracked on the branch;
-    user-owned, copy verbatim)
   - Make .gitignore cover secrets (.env, _.key, _.pem), OS files
     (.DS_Store), and editor files (_.swp, _~)
   - Make fmt-check/lint verify with gofumpt, not gofmt -l, so
@@ -55,8 +59,8 @@ commit the uncommitted work (32 modified Go files, new untracked
     install/usage block
   - Move FORMAT.md from repo root to docs/ and update the AGENTS.md
     reference
-  - Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1,
-    golangci-lint@v2.0.2) by module hash, not mutable tag
+  - Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
+    `golangci-lint@v2.12.2`) by module hash, not mutable tag
   - Set `make test` timeout to 30s (currently 10s)
   - Add explicit README "Rationale" heading (content exists under other
     names); name the author in the README Description first line