chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

TODO.md

@@ -24,6 +24,16 @@ fill up
 
 # Completed Steps
 
+- 2026-08-07 update golangci-lint to v2.12.2 with the canonical
+  `.golangci.yml` (v2 schema, `default: all` minus six disabled
+  linters, `lll` 88, tests included): bumped the pinned
+  `golangci/golangci-lint:v2.12.2-alpine` image in `Dockerfile` and the
+  release-archive sha256 pins in `script/bootstrap`; fixed all 747
+  findings the stricter config surfaced (notably `paralleltest`,
+  `wsl_v5`, `goconst`, `lll`, `noinlineerr`, `err113`, `errcheck`,
+  `testpackage` — white-box test files renamed to
+  `*_internal_test.go`); three `//nolint:tagliatelle` directives keep
+  the snake_case JSON wire/disk formats unchanged; `make check` green
 - 2026-08-07 manual test pass of the auth and encrypted URL flows
   against a locally built and running `pixad` (built from `main` at
   `6573b9d`, port 18099, local throwaway config); all six checks