chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/httpfetcher/mock.go

@@ -4,12 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"io/fs"
 	"net/http"
 	"strings"
 )
 
+// errEmptyURLPath is returned when a mock URL has no usable path.
+var errEmptyURLPath = errors.New("empty URL path")
+
 // MockFetcher implements Fetcher using an embedded filesystem.
 // Files are organized as: hostname/path/to/file.ext
 // URLs like https://example.com/images/photo.jpg map to example.com/images/photo.jpg.
@@ -59,7 +61,7 @@ func (m *MockFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 	contentType := detectContentTypeFromPath(path)
 
 	return &FetchResult{
-		Content:       f.(io.ReadCloser),
+		Content:       f,
 		ContentLength: stat.Size(),
 		ContentType:   contentType,
 		Headers:       make(http.Header),
@@ -86,7 +88,7 @@ func urlToFSPath(rawURL string) (string, error) {
 	}
 
 	if url == "" {
-		return "", errors.New("empty URL path")
+		return "", errEmptyURLPath
 	}
 
 	return url, nil
@@ -98,18 +100,18 @@ func detectContentTypeFromPath(path string) string {
 
 	switch {
 	case strings.HasSuffix(path, ".jpg"), strings.HasSuffix(path, ".jpeg"):
-		return "image/jpeg"
+		return contentTypeJPEG
 	case strings.HasSuffix(path, ".png"):
-		return "image/png"
+		return contentTypePNG
 	case strings.HasSuffix(path, ".gif"):
-		return "image/gif"
+		return contentTypeGIF
 	case strings.HasSuffix(path, ".webp"):
-		return "image/webp"
+		return contentTypeWebP
 	case strings.HasSuffix(path, ".avif"):
-		return "image/avif"
+		return contentTypeAVIF
 	case strings.HasSuffix(path, ".svg"):
-		return "image/svg+xml"
+		return contentTypeSVG
 	default:
-		return "application/octet-stream"
+		return contentTypeOctetStream
 	}
 }