lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)

The old backend/.golangci.yml declared version "2" but used v1 schema
keys, so under v2 it never validated and its thresholds were inert: the
linter ran at defaults. Replace it verbatim with the org-standard file,
repin the Dockerfile.backend lint stage from golangci-lint v2.7.2 to
v2.12.2, and assert the config's sha256 as the first step of the backend
lint target so it cannot silently drift again -- a local hash check
against a constant, no network. With the config loading, lll flags one
over-long line; wrap it and the two others named on the issue, moving
each //nolint justification above the code line, and drop a dead
//nolint:wsl (wsl is disabled by the standard config). TODO.md updated.

Model: opus-4-8

backend/internal/reportbuf/reportbuf.go

@@ -163,7 +163,9 @@ func (b *Buffer) writeFile(data []byte) {
 	name := fmt.Sprintf("reports-%s.jsonl.zst", ts)
 	path := filepath.Join(b.dataDir, name)
 
-	f, err := os.OpenFile( //nolint:gosec // path built from controlled dataDir + timestamp
+	// path is built from the operator-supplied dataDir plus a
+	// generated timestamp, so it carries no external input.
+	f, err := os.OpenFile( //nolint:gosec // see comment above
 		path,
 		os.O_WRONLY|os.O_CREATE|os.O_EXCL,
 		filePerms,