next -> main (1.0.0 milestone) (#105)

Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice.

Landed so far:

- `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix.

Sequencing for the milestone is tracked in #103.

Reviewed-on: #105
Co-authored-by: clawbot <clawbot@noreply.example.org>

internal/encurl/encurl.go

@@ -48,7 +48,8 @@ type Generator struct {
 	key [seal.KeySize]byte
 }
 
-// NewGenerator creates an encrypted URL generator with a key derived from the signing key.
+// NewGenerator creates an encrypted URL generator with a key derived
+// from the signing key.
 func NewGenerator(signingKey string) (*Generator, error) {
 	key, err := seal.DeriveKey([]byte(signingKey), urlKeySalt)
 	if err != nil {
@@ -77,7 +78,8 @@ func (g *Generator) Parse(token string) (*Payload, error) {
 	// Decrypt
 	data, err := seal.Decrypt(g.key, token)
 	if err != nil {
-		if errors.Is(err, seal.ErrDecryptionFailed) || errors.Is(err, seal.ErrInvalidPayload) {
+		if errors.Is(err, seal.ErrDecryptionFailed) ||
+			errors.Is(err, seal.ErrInvalidPayload) {
 			return nil, ErrDecryptFailed
 		}
 
@@ -86,7 +88,9 @@ func (g *Generator) Parse(token string) (*Payload, error) {
 
 	// CBOR decode
 	var p Payload
-	if err := cbor.Unmarshal(data, &p); err != nil {
+
+	err = cbor.Unmarshal(data, &p)
+	if err != nil {
 		return nil, ErrInvalidFormat
 	}