chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/signature/golden_test.go

@@ -1,8 +1,10 @@
-package signature
+package signature_test
 
 import (
 	"testing"
 	"time"
+
+	"sneak.berlin/go/pixa/internal/signature"
 )
 
 // goldenExpiresUnix is the fixed expiration timestamp used by all golden
@@ -12,10 +14,74 @@ const goldenExpiresUnix int64 = 1704067200
 // goldenSigningKey is the fixed signing key used by all golden vectors.
 const goldenSigningKey = "golden-test-key"
 
+type goldenVector struct {
+	name string
+	req  signature.Request
+	// wantSignature is the exact base64url (RFC 4648 URL-safe,
+	// padded) HMAC-SHA256 signature for the request with Expires
+	// set to goldenExpiresUnix.
+	wantSignature string
+	// wantSignedPath is the exact path returned by
+	// GenerateSignedURL for the request. The signature and
+	// expiration are returned separately by GenerateSignedURL and
+	// are not embedded in the path.
+	wantSignedPath string
+}
+
+// goldenVectors returns the known-answer vectors. The expected values
+// were computed once and are hardcoded here.
+func goldenVectors() []goldenVector {
+	return []goldenVector{
+		{
+			name: "resized without query",
+			req: signature.Request{
+				SourceHost:  testHost,
+				SourcePath:  testPath,
+				SourceQuery: "",
+				Width:       800,
+				Height:      600,
+				Format:      testFormatWebP,
+			},
+			// Signed data: "cdn.example.com:/photos/cat.jpg::800:600:webp:1704067200"
+			wantSignature:  "x5PfPp8QSDo0cJT96od-AEgrQyOVLfqifH5sst61_-w=",
+			wantSignedPath: testSignedPath,
+		},
+		{
+			name: "resized with query string",
+			req: signature.Request{
+				SourceHost:  testHost,
+				SourcePath:  testPath,
+				SourceQuery: "token=abc&v=2",
+				Width:       800,
+				Height:      600,
+				Format:      testFormatWebP,
+			},
+			// Signed data:
+			// "cdn.example.com:/photos/cat.jpg:token=abc&v=2:800:600:webp:1704067200"
+			wantSignature: "394_Vf9TdQFkpQ3XKFDQSyxgqKq8N7mApf2S4QaHqyo=",
+			wantSignedPath: "/v1/image/cdn.example.com/photos/cat.jpg" +
+				"%3Ftoken=abc&v=2/800x600.webp",
+		},
+		{
+			name: "original size without query",
+			req: signature.Request{
+				SourceHost:  testHost,
+				SourcePath:  testPath,
+				SourceQuery: "",
+				Width:       0,
+				Height:      0,
+				Format:      testFormatPNG,
+			},
+			// Signed data: "cdn.example.com:/photos/cat.jpg::0:0:png:1704067200"
+			wantSignature:  "7Be7oteeQwvnSPU4bchyQ4ZGYGsAGBKpeEtuQ02ox60=",
+			wantSignedPath: "/v1/image/cdn.example.com/photos/cat.jpg/orig.png",
+		},
+	}
+}
+
 // TestSigner_GoldenVectors pins the exact HMAC-SHA256 signature output and
 // the exact generated signed URL path for fully-specified requests with a
-// hardcoded signing key. The expected values were computed once and are
-// hardcoded here as known answers.
+// hardcoded signing key.
 //
 // If any of these assertions fail, the signed byte format
 // ("host:path:query:width:height:format:expiration"), the base64url
@@ -24,67 +90,14 @@ const goldenSigningKey = "golden-test-key"
 // deliberately: update these constants only as part of an intentional,
 // documented signature format migration.
 func TestSigner_GoldenVectors(t *testing.T) {
-	signer := New(goldenSigningKey)
+	t.Parallel()
 
-	vectors := []struct {
-		name string
-		req  Request
-		// wantSignature is the exact base64url (RFC 4648 URL-safe,
-		// padded) HMAC-SHA256 signature for the request with Expires
-		// set to goldenExpiresUnix.
-		wantSignature string
-		// wantSignedPath is the exact path returned by
-		// GenerateSignedURL for the request. The signature and
-		// expiration are returned separately by GenerateSignedURL and
-		// are not embedded in the path.
-		wantSignedPath string
-	}{
-		{
-			name: "resized without query",
-			req: Request{
-				SourceHost:  "cdn.example.com",
-				SourcePath:  "/photos/cat.jpg",
-				SourceQuery: "",
-				Width:       800,
-				Height:      600,
-				Format:      "webp",
-			},
-			// Signed data: "cdn.example.com:/photos/cat.jpg::800:600:webp:1704067200"
-			wantSignature:  "x5PfPp8QSDo0cJT96od-AEgrQyOVLfqifH5sst61_-w=",
-			wantSignedPath: "/v1/image/cdn.example.com/photos/cat.jpg/800x600.webp",
-		},
-		{
-			name: "resized with query string",
-			req: Request{
-				SourceHost:  "cdn.example.com",
-				SourcePath:  "/photos/cat.jpg",
-				SourceQuery: "token=abc&v=2",
-				Width:       800,
-				Height:      600,
-				Format:      "webp",
-			},
-			// Signed data: "cdn.example.com:/photos/cat.jpg:token=abc&v=2:800:600:webp:1704067200"
-			wantSignature:  "394_Vf9TdQFkpQ3XKFDQSyxgqKq8N7mApf2S4QaHqyo=",
-			wantSignedPath: "/v1/image/cdn.example.com/photos/cat.jpg%3Ftoken=abc&v=2/800x600.webp",
-		},
-		{
-			name: "original size without query",
-			req: Request{
-				SourceHost:  "cdn.example.com",
-				SourcePath:  "/photos/cat.jpg",
-				SourceQuery: "",
-				Width:       0,
-				Height:      0,
-				Format:      "png",
-			},
-			// Signed data: "cdn.example.com:/photos/cat.jpg::0:0:png:1704067200"
-			wantSignature:  "7Be7oteeQwvnSPU4bchyQ4ZGYGsAGBKpeEtuQ02ox60=",
-			wantSignedPath: "/v1/image/cdn.example.com/photos/cat.jpg/orig.png",
-		},
-	}
+	signer := signature.New(goldenSigningKey)
 
-	for _, tt := range vectors {
+	for _, tt := range goldenVectors() {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			signReq := tt.req
 			signReq.Expires = time.Unix(goldenExpiresUnix, 0)
 
@@ -95,9 +108,10 @@ func TestSigner_GoldenVectors(t *testing.T) {
 			}
 
 			urlReq := tt.req
+
 			gotPath, _, _ := signer.GenerateSignedURL(&urlReq, time.Hour)
 			if gotPath != tt.wantSignedPath {
-				t.Errorf("GenerateSignedURL() path = %q, want %q (signed URL layout changed?)",
+				t.Errorf("GenerateSignedURL() path = %q, want %q (layout changed?)",
 					gotPath, tt.wantSignedPath)
 			}
 		})