Update golangci-lint to v2.12.2 with canonical config (closes #60)

Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree.

Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker.

All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.

TODO.md

@@ -16,13 +16,19 @@ in flight and unmerged.
 
 # Next Step
 
-Land the in-flight compliance branch chore/align-repo-policies: finish and
-commit the uncommitted work (32 modified Go files, new untracked
-.golangci.yml and TODO.md), confirm `make check` is green, merge the branch
-(one commit ahead of main as of 2026-07-03) to main, and push.
+Work through the remaining compliance items folded from the 2026-07-02
+audit (the first group under Future Steps): `.editorconfig`, `.gitignore`
+coverage, gofumpt-based `fmt-check`, README "Getting Started", and the
+rest. `.golangci.yml` and `TODO.md` are tracked and committed as of
+2026-08-07, so the only thing left of the `chore/align-repo-policies`
+branch is the list below.
 
 # Completed Steps
 
+- 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned
+  (`Makefile`, `Dockerfile`), added the canonical `.golangci.yml`
+  (`default: all`), and fixed all resulting lint findings across the
+  codebase
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-07-03: aligned repo tooling, docs, and config with standardized
@@ -45,8 +51,6 @@ commit the uncommitted work (32 modified Go files, new untracked
 - Compliance (fold of TODO.md audit 2026-07-02; verify which items the
   in-flight branch already closes, then check off):
   - Add .editorconfig (canonical copy from sneak/prompts)
-  - Add standardized .golangci.yml (present untracked on the branch;
-    user-owned, copy verbatim)
   - Make .gitignore cover secrets (.env, _.key, _.pem), OS files
     (.DS_Store), and editor files (_.swp, _~)
   - Make fmt-check/lint verify with gofumpt, not gofmt -l, so
@@ -55,8 +59,8 @@ commit the uncommitted work (32 modified Go files, new untracked
     install/usage block
   - Move FORMAT.md from repo root to docs/ and update the AGENTS.md
     reference
-  - Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1,
-    golangci-lint@v2.0.2) by module hash, not mutable tag
+  - Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
+    `golangci-lint@v2.12.2`) by module hash, not mutable tag
   - Set `make test` timeout to 30s (currently 10s)
   - Add explicit README "Rationale" heading (content exists under other
     names); name the author in the README Description first line