Update golangci-lint to v2.12.2 with canonical config

- Add canonical .golangci.yml (v2 schema, default: all, project
  thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
  (go install, new /v2 module path) and Dockerfile (tagged+digest
  Debian image pin)
- Fix all lint findings surfaced by the new linter set across
  cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
  static sentinel errors (err113), context-aware HTTP and exec
  (noctx), guarded integer conversions and stricter permissions
  (gosec), named constants (mnd, goconst), function decomposition
  (funlen, cyclop, gocognit, nestif), declaration ordering
  (funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
  (paralleltest, usetesting), protobuf getters (protogetter), plus
  formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
  testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
  not cross-wire the process-global logger's captured output

internal/cli/freshen_test.go

@@ -1,3 +1,4 @@
+//nolint:testpackage // white-box tests exercise unexported internals
 package cli
 
 import (
@@ -11,24 +12,34 @@ import (
 	"sneak.berlin/go/mfer/mfer"
 )
 
-func TestFreshenUnchanged(t *testing.T) {
-	// Create filesystem with test files
-	fs := afero.NewMemMapFs()
+// setupFreshenDir populates /testdir with two files, scans it, and
+// writes the resulting manifest to /testdir/.index.mf.
+func setupFreshenDir(t *testing.T, fs afero.Fs) {
+	t.Helper()
 
-	require.NoError(t, fs.MkdirAll("/testdir", 0o755))
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file1.txt", []byte("content1"), 0o644))
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file2.txt", []byte("content2"), 0o644))
+	require.NoError(t, fs.MkdirAll(testDir, 0o755))
+	writeTestFile(t, fs, testFile1, "content1")
+	writeTestFile(t, fs, "/testdir/file2.txt", "content2")
 
 	// Generate initial manifest
 	opts := &mfer.ScannerOptions{Fs: fs}
 	s := mfer.NewScannerWithOptions(opts)
-	require.NoError(t, s.EnumeratePath("/testdir", nil))
+	require.NoError(t, s.EnumeratePath(testDir, nil))
 
 	var manifestBuf bytes.Buffer
+
 	require.NoError(t, s.ToManifest(context.Background(), &manifestBuf, nil))
 
 	// Write manifest to filesystem
-	require.NoError(t, afero.WriteFile(fs, "/testdir/.index.mf", manifestBuf.Bytes(), 0o644))
+	require.NoError(t,
+		afero.WriteFile(fs, "/testdir/.index.mf", manifestBuf.Bytes(), 0o644))
+}
+
+func TestFreshenUnchanged(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	setupFreshenDir(t, fs)
 
 	// Parse manifest to verify
 	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
@@ -37,23 +48,10 @@ func TestFreshenUnchanged(t *testing.T) {
 }
 
 func TestFreshenWithChanges(t *testing.T) {
-	// Create filesystem with test files
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
-
-	require.NoError(t, fs.MkdirAll("/testdir", 0o755))
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file1.txt", []byte("content1"), 0o644))
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file2.txt", []byte("content2"), 0o644))
-
-	// Generate initial manifest
-	opts := &mfer.ScannerOptions{Fs: fs}
-	s := mfer.NewScannerWithOptions(opts)
-	require.NoError(t, s.EnumeratePath("/testdir", nil))
-
-	var manifestBuf bytes.Buffer
-	require.NoError(t, s.ToManifest(context.Background(), &manifestBuf, nil))
-
-	// Write manifest to filesystem
-	require.NoError(t, afero.WriteFile(fs, "/testdir/.index.mf", manifestBuf.Bytes(), 0o644))
+	setupFreshenDir(t, fs)
 
 	// Verify initial manifest has 2 files
 	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
@@ -61,17 +59,17 @@ func TestFreshenWithChanges(t *testing.T) {
 	assert.Len(t, manifest.Files(), 2)
 
 	// Add a new file
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file3.txt", []byte("content3"), 0o644))
+	writeTestFile(t, fs, "/testdir/file3.txt", "content3")
 
 	// Modify file2 (change content and size)
-	require.NoError(t, afero.WriteFile(fs, "/testdir/file2.txt", []byte("modified content2"), 0o644))
+	writeTestFile(t, fs, "/testdir/file2.txt", "modified content2")
 
 	// Remove file1
-	require.NoError(t, fs.Remove("/testdir/file1.txt"))
+	require.NoError(t, fs.Remove(testFile1))
 
 	// Note: The freshen operation would need to be run here
 	// For now, we just verify the test setup is correct
-	exists, _ := afero.Exists(fs, "/testdir/file1.txt")
+	exists, _ := afero.Exists(fs, testFile1)
 	assert.False(t, exists)
 
 	exists, _ = afero.Exists(fs, "/testdir/file3.txt")