Update golangci-lint to v2.12.2 with canonical config

- Add canonical .golangci.yml (v2 schema, default: all, project
  thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
  (go install, new /v2 module path) and Dockerfile (tagged+digest
  Debian image pin)
- Fix all lint findings surfaced by the new linter set across
  cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
  static sentinel errors (err113), context-aware HTTP and exec
  (noctx), guarded integer conversions and stricter permissions
  (gosec), named constants (mnd, goconst), function decomposition
  (funlen, cyclop, gocognit, nestif), declaration ordering
  (funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
  (paralleltest, usetesting), protobuf getters (protogetter), plus
  formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
  testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
  not cross-wire the process-global logger's captured output

internal/cli/manifest_loader.go

@@ -1,6 +1,8 @@
 package cli
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -10,6 +12,13 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+// manifestFetchTimeout bounds HTTP requests made to fetch a manifest.
+const manifestFetchTimeout = 30 * time.Second
+
+// errUnexpectedHTTPStatus indicates an HTTP response with a non-OK
+// status code.
+var errUnexpectedHTTPStatus = errors.New("unexpected HTTP status")
+
 // isHTTPURL returns true if the string starts with http:// or https://.
 func isHTTPURL(s string) bool {
 	return strings.HasPrefix(s, "http://") || strings.HasPrefix(s, "https://")
@@ -19,21 +28,35 @@ func isHTTPURL(s string) bool {
 // The caller must close the returned reader.
 func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 	if isHTTPURL(pathOrURL) {
-		client := &http.Client{Timeout: 30 * time.Second}
-		resp, err := client.Get(pathOrURL) //nolint:gosec // user-provided URL is intentional
+		client := &http.Client{Timeout: manifestFetchTimeout}
+
+		req, err := http.NewRequestWithContext(
+			context.Background(), http.MethodGet, pathOrURL, nil,
+		)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
 		}
+
+		resp, err := client.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
+		}
+
 		if resp.StatusCode != http.StatusOK {
 			_ = resp.Body.Close()
-			return nil, fmt.Errorf("failed to fetch %s: HTTP %d", pathOrURL, resp.StatusCode)
+
+			return nil, fmt.Errorf("failed to fetch %s: %w: HTTP %d",
+				pathOrURL, errUnexpectedHTTPStatus, resp.StatusCode)
 		}
+
 		return resp.Body, nil
 	}
+
 	f, err := mfa.Fs.Open(pathOrURL)
 	if err != nil {
 		return nil, err
 	}
+
 	return f, nil
 }
 
@@ -46,11 +69,14 @@ func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
 		if isHTTPURL(arg) {
 			return arg, nil
 		}
+
 		info, statErr := mfa.Fs.Stat(arg)
 		if statErr == nil && info.IsDir() {
 			return findManifest(mfa.Fs, arg)
 		}
+
 		return arg, nil
 	}
+
 	return findManifest(mfa.Fs, ".")
 }