chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/magic/magic.go

@@ -46,6 +46,10 @@ const (
 // MinMagicBytes is the minimum number of bytes needed to detect format.
 const MinMagicBytes = 12
 
+// mimeOctetStream is the fallback MIME type for formats without a
+// specific MIME type.
+const mimeOctetStream = "application/octet-stream"
+
 // Magic byte signatures for supported formats.
 // These are effectively constants but Go doesn't support const slices.
 //
@@ -190,14 +194,17 @@ func IsSupportedMIMEType(mimeType string) bool {
 func PeekAndValidate(r io.Reader, declaredType string) (io.Reader, error) {
 	// Read minimum bytes for detection
 	buf := make([]byte, MinMagicBytes)
+
 	n, err := io.ReadFull(r, buf)
-	if err != nil && err != io.ErrUnexpectedEOF {
+	if err != nil && !errors.Is(err, io.ErrUnexpectedEOF) {
 		return nil, err
 	}
+
 	buf = buf[:n]
 
 	// Validate magic bytes
-	if err := ValidateMagicBytes(buf, declaredType); err != nil {
+	err = ValidateMagicBytes(buf, declaredType)
+	if err != nil {
 		return nil, err
 	}
 
@@ -219,6 +226,9 @@ func MIMEToImageFormat(mimeType string) (ImageFormat, bool) {
 		return FormatGIF, true
 	case MIMETypeAVIF:
 		return FormatAVIF, true
+	case MIMETypeSVG:
+		// SVG has no corresponding output format.
+		return "", false
 	default:
 		return "", false
 	}
@@ -237,7 +247,10 @@ func ImageFormatToMIME(format ImageFormat) string {
 		return string(MIMETypeGIF)
 	case FormatAVIF:
 		return string(MIMETypeAVIF)
+	case FormatOriginal:
+		// Original format passes content through unchanged.
+		return mimeOctetStream
 	default:
-		return "application/octet-stream"
+		return mimeOctetStream
 	}
 }