chore: conform post-merge config validation code to v2.12.2 lint config

The stricter canonical .golangci.yml surfaced 81 findings in the
config validation code merged from main (#53). Fix them all with no
behavior change: static sentinel errors wrapped with %w preserving the
existing messages (err113), config key name constants (goconst),
t.Parallel() throughout except the Setenv/Chdir test (paralleltest),
white-box test renamed to config_validation_internal_test.go
(testpackage), case tables extracted into builder functions plus a
shared runAbortCases helper (funlen/dupl/gochecknoglobals), plain
error assignments (noinlineerr), any instead of interface{} and
strings.SplitSeq (modernize), slog.DiscardHandler (sloglint), 88-col
wrapping (lll), and removal of two stale nolint:gosec directives
(nolintlint).

internal/config/config_internal_test.go

@@ -40,7 +40,7 @@ func checkAllowlistHosts(t *testing.T, configPath string) {
 		t.Errorf("expected 3 hosts, got %d: %v", len(hosts), hosts)
 	}
 
-	expected := []string{"static.sneak.cloud", "sneak.berlin", "s3.sneak.cloud"}
+	expected := []string{"static.sneak.cloud", "sneak.berlin", testHostS3}
 	for i, want := range expected {
 		if i >= len(hosts) {
 			t.Errorf("missing host at index %d: want %q", i, want)