lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)

backend/.golangci.yml declared version: "2" on line 1 but used the
golangci-lint v1 schema below it: a top-level linters-settings key and
an issues.exclude-use-default key that does not exist in v2. Under v2
that config does not validate, so every threshold in it was inert --
lll fell back to its 120-column default rather than the intended 88,
and funlen, cyclop and dupl were not applied at all. The `0 issues.`
result the repo has been relying on was therefore meaningless.

Replace it with the org-standard file verbatim (sha256
021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb) and
move the lint stage of Dockerfile.backend from golangci-lint v2.7.2 to
the org-standard v2.12.2 by repinning the golangci/golangci-lint image
digest:

  sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240

The digest was resolved from the v2.12.2 tag and verified by running
the linter out of that exact image, which reports "golangci-lint has
version 2.12.2 built with go1.26.2 from c0d3ddc9 on
2026-05-06T11:07:58Z".

Guard against the config drifting from the standard again by asserting
its sha256 as the first step of the backend lint target. The check is a
local hash comparison against a constant in the Makefile: it needs no
network, fetches nothing, and adds no unpinned external reference to
the build path. It also catches a strictly larger class of breakage
than schema validation would, since a schema-valid but non-canonical
config is exactly how this file got into its broken state.

With the config actually loading, lll reports server.go:65 at 93
columns. Fix it, plus the two other over-long lines called out on the
issue (server.go:97 at 81 and reportbuf.go:166 at 88) which are inside
the 88-column lint limit but over the 77-column hard wrap in the Go
styleguide. All three were long //nolint justifications on the code
line; move the justification into a preceding comment block and leave
a short directive behind. No suppression is added or widened, and
.golangci.yml is not touched after the copy.

Drop the //nolint:wsl in server.go entirely rather than relocating it.
The standard config disables wsl, so the directive suppressed nothing;
removing it still yields `0 issues.`

Verified: `docker build --no-cache -f Dockerfile.backend .` is green,
with the lint stage running uncached for 14.9s and reporting
`0 issues.` -- the first proof that v2.12.2 and the canonical config
pass together through the multistage lint stage. Root `make check` and
`cd backend && make check` both pass. The drift guard's failure path
was re-proved inside the lint image: appending a byte to
.golangci.yml fails `make lint` at 0.17s with the expected and actual
hashes, before golangci-lint runs at all.

golangci-lint v2.12.2 emits a deprecation warning for the gomodguard
linter the standard config enables. It is a warning, not a failure,
and the config is not editable here; it is tracked separately.

backend/internal/reportbuf/reportbuf.go

@@ -163,7 +163,9 @@ func (b *Buffer) writeFile(data []byte) {
 	name := fmt.Sprintf("reports-%s.jsonl.zst", ts)
 	path := filepath.Join(b.dataDir, name)
 
-	f, err := os.OpenFile( //nolint:gosec // path built from controlled dataDir + timestamp
+	// path is built from the operator-supplied dataDir plus a
+	// generated timestamp, so it carries no external input.
+	f, err := os.OpenFile( //nolint:gosec // see comment above
 		path,
 		os.O_WRONLY|os.O_CREATE|os.O_EXCL,
 		filePerms,