Update golangci-lint to v2.12.2 with canonical config

- Add canonical .golangci.yml (v2 schema, default: all, project
  thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
  (go install, new /v2 module path) and Dockerfile (tagged+digest
  Debian image pin)
- Fix all lint findings surfaced by the new linter set across
  cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
  static sentinel errors (err113), context-aware HTTP and exec
  (noctx), guarded integer conversions and stricter permissions
  (gosec), named constants (mnd, goconst), function decomposition
  (funlen, cyclop, gocognit, nestif), declaration ordering
  (funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
  (paralleltest, usetesting), protobuf getters (protogetter), plus
  formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
  testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
  not cross-wire the process-global logger's captured output

internal/bork/error.go

@@ -1,15 +1,14 @@
+// Package bork defines the sentinel errors used by the manifest
+// reader and writer.
 package bork
 
 import (
 	"errors"
-	"fmt"
 )
 
 var (
-	ErrMissingMagic  = errors.New("missing magic bytes in file")
+	// ErrMissingMagic indicates the input lacks the manifest magic bytes.
+	ErrMissingMagic = errors.New("missing magic bytes in file")
+	// ErrFileTruncated indicates the input ended before the expected length.
 	ErrFileTruncated = errors.New("file/stream is truncated abnormally")
 )
-
-func Newf(format string, args ...interface{}) error {
-	return fmt.Errorf(format, args...)
-}