Update golangci-lint to v2.12.2 with canonical config (closes #60)

Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree.

Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker.

All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.

cmd/mfer/main.go

@@ -1,3 +1,4 @@
+// Command mfer generates and verifies file manifests.
 package main
 
 import (
@@ -6,8 +7,13 @@ import (
 	"sneak.berlin/go/mfer/internal/cli"
 )
 
+// Appname is the name of this program.
+const Appname = "mfer"
+
+// Version and Gitrev are injected at build time via -ldflags.
+//
+//nolint:gochecknoglobals // set via ldflags at build time
 var (
-	Appname string = "mfer"
 	Version string
 	Gitrev  string
 )