chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/imgcache/negative_cache_internal_test.go

@@ -0,0 +1,109 @@
+package imgcache
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestNegativeCache_StoreAndCheck(t *testing.T) {
+	t.Parallel()
+
+	db := setupTestDB(t)
+	dir := t.TempDir()
+
+	cache, err := NewCache(db, CacheConfig{
+		StateDir:    dir,
+		CacheTTL:    time.Hour,
+		NegativeTTL: 5 * time.Minute,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	req := &ImageRequest{
+		SourceHost: testHostExample,
+		SourcePath: "/missing.jpg",
+	}
+
+	// Initially should not be in negative cache
+	hit, err := cache.checkNegativeCache(ctx, req)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if hit {
+		t.Error("expected no negative cache hit initially")
+	}
+
+	// Store a negative entry
+	err = cache.StoreNegative(ctx, req, 404, "not found")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Now should be in negative cache
+	hit, err = cache.checkNegativeCache(ctx, req)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !hit {
+		t.Error("expected negative cache hit after storing")
+	}
+}
+
+func TestNegativeCache_Expired(t *testing.T) {
+	t.Parallel()
+
+	db := setupTestDB(t)
+	dir := t.TempDir()
+
+	cache, err := NewCache(db, CacheConfig{
+		StateDir:    dir,
+		CacheTTL:    time.Hour,
+		NegativeTTL: 1 * time.Millisecond, // very short TTL
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	req := &ImageRequest{
+		SourceHost: testHostExample,
+		SourcePath: "/expired.jpg",
+	}
+
+	// Store a negative entry with very short TTL
+	err = cache.StoreNegative(ctx, req, 500, "server error")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for expiry
+	time.Sleep(10 * time.Millisecond)
+
+	// Should no longer be in negative cache
+	hit, err := cache.checkNegativeCache(ctx, req)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if hit {
+		t.Error("expected expired negative cache entry to be a miss")
+	}
+}
+
+func TestService_Get_ReturnsErrorForNegativeCachedURL(t *testing.T) {
+	t.Parallel()
+
+	// This test verifies that Service.Get() checks the negative cache
+	// We can't easily test the full pipeline without vips, but we can
+	// verify the error type
+	err := ErrNegativeCached
+	if !errors.Is(err, ErrNegativeCached) {
+		t.Error("ErrNegativeCached should be identifiable with errors.Is")
+	}
+}