Update golangci-lint to v2.12.2 with canonical config (closes #60)

Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree.

Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker.

All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.

cmd/mfer/main.go

@@ -1,3 +1,4 @@
+// Command mfer generates and verifies file manifests.
 package main
 
 import (
@@ -6,8 +7,13 @@ import (
 	"sneak.berlin/go/mfer/internal/cli"
 )
 
+// Appname is the name of this program.
+const Appname = "mfer"
+
+// Version and Gitrev are injected at build time via -ldflags.
+//
+//nolint:gochecknoglobals // set via ldflags at build time
 var (
-	Appname string = "mfer"
 	Version string
 	Gitrev  string
 )

cmd/mfer/main_test.go

@@ -6,6 +6,20 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestBuild(t *testing.T) {
-	assert.True(t, true)
+// TestAppname pins the program name that main passes to cli.Run; it is
+// the name that appears in usage output and in the log prefix. It also
+// keeps this package compiled under `go test`.
+func TestAppname(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, "mfer", Appname)
+}
+
+// TestVersionDefaults documents that Version and Gitrev are empty unless
+// injected at build time via -ldflags.
+func TestVersionDefaults(t *testing.T) {
+	t.Parallel()
+
+	assert.Empty(t, Version)
+	assert.Empty(t, Gitrev)
 }