Update golangci-lint to v2.12.2 with canonical config

- Add canonical .golangci.yml (v2 schema, default: all, project
  thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
  (go install, new /v2 module path) and Dockerfile (tagged+digest
  Debian image pin)
- Fix all lint findings surfaced by the new linter set across
  cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
  static sentinel errors (err113), context-aware HTTP and exec
  (noctx), guarded integer conversions and stricter permissions
  (gosec), named constants (mnd, goconst), function decomposition
  (funlen, cyclop, gocognit, nestif), declaration ordering
  (funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
  (paralleltest, usetesting), protobuf getters (protogetter), plus
  formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
  testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
  not cross-wire the process-global logger's captured output

internal/cli/entry.go

@@ -7,15 +7,18 @@ import (
 	"github.com/spf13/afero"
 )
 
-// NO_COLOR disables colored output when set. Automatically true if the
+// NoColor disables colored output when set. Automatically true if the
 // NO_COLOR environment variable is present (per https://no-color.org/).
-var NO_COLOR bool
+//
+//nolint:gochecknoglobals // process-wide setting derived from the environment
+var NoColor = noColorEnvSet()
 
-func init() {
-	NO_COLOR = false
-	if _, exists := os.LookupEnv("NO_COLOR"); exists {
-		NO_COLOR = true
-	}
+// noColorEnvSet reports whether the NO_COLOR environment variable is
+// present.
+func noColorEnvSet() bool {
+	_, exists := os.LookupEnv("NO_COLOR")
+
+	return exists
 }
 
 // RunOptions contains all configuration for running the CLI application.
@@ -64,5 +67,6 @@ func RunWithOptions(opts *RunOptions) int {
 	}
 
 	m.run(opts.Args)
+
 	return m.exitCode
 }