chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/seal/crypto.go

@@ -34,7 +34,8 @@ func DeriveKey(masterKey []byte, salt string) ([KeySize]byte, error) {
 
 	hkdfReader := hkdf.New(sha256.New, masterKey, []byte(salt), nil)
 
-	if _, err := io.ReadFull(hkdfReader, key[:]); err != nil {
+	_, err := io.ReadFull(hkdfReader, key[:])
+	if err != nil {
 		return key, ErrKeyDerivation
 	}
 
@@ -46,7 +47,9 @@ func DeriveKey(masterKey []byte, salt string) ([KeySize]byte, error) {
 func Encrypt(key [KeySize]byte, plaintext []byte) (string, error) {
 	// Generate random nonce
 	var nonce [NonceSize]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
+
+	_, err := rand.Read(nonce[:])
+	if err != nil {
 		return "", err
 	}