chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/healthcheck/healthcheck.go

@@ -16,6 +16,7 @@ import (
 // Params defines dependencies for Healthcheck.
 type Params struct {
 	fx.In
+
 	Globals  *globals.Globals
 	Config   *config.Config
 	Logger   *logger.Logger
@@ -53,6 +54,8 @@ func New(lc fx.Lifecycle, params Params) (*Healthcheck, error) {
 }
 
 // Response is the JSON response for health checks.
+//
+//nolint:tagliatelle // health endpoint response format uses snake_case
 type Response struct {
 	Status        string `json:"status"`
 	Now           string `json:"now"`
@@ -63,10 +66,6 @@ type Response struct {
 	Maintenance   bool   `json:"maintenance_mode"`
 }
 
-func (s *Healthcheck) uptime() time.Duration {
-	return time.Since(s.StartupTime)
-}
-
 // Healthcheck returns the current health status.
 func (s *Healthcheck) Healthcheck() *Response {
 	resp := &Response{
@@ -81,3 +80,7 @@ func (s *Healthcheck) Healthcheck() *Response {
 
 	return resp
 }
+
+func (s *Healthcheck) uptime() time.Duration {
+	return time.Since(s.StartupTime)
+}