chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

TODO.md

@@ -27,11 +27,22 @@ P1: implement blocked networks configuration to extend SSRF protection
   `.golangci.yml` (v2 schema, `default: all` minus six disabled
   linters, `lll` 88, tests included): bumped the pinned
   `golangci/golangci-lint:v2.12.2-alpine` image in `Dockerfile` and the
-  release-archive sha256 pins in `script/bootstrap`; fixed all 747
+  release-archive sha256 pins in `script/bootstrap`; fixed the findings
-  findings the stricter config surfaced (notably `paralleltest`,
+  the stricter config surfaced (notably `paralleltest`, `wsl_v5`,
-  `wsl_v5`, `goconst`, `lll`, `noinlineerr`, `err113`, `errcheck`,
+  `goconst`, `lll`, `noinlineerr`, `err113`, `errcheck`, `testpackage` —
-  `testpackage` — white-box test files renamed to
+  white-box test files renamed to `*_internal_test.go`), including #55's
-  `*_internal_test.go`); three `//nolint:tagliatelle` directives keep
+  code absorbed after it merged, iterating the pinned linter to
+  `0 issues.`; no single finding total is substantiable, since
+  golangci-lint's `uniq-by-line` reveals new findings on a line as
+  others there are fixed — the documented re-measurements were 81 after
+  the #53 merge and 149 after the #55 merge; three behavior changes, so
+  not a pure no-op: `Cache.StoreVariant` now takes a `context.Context`
+  (`noctx`), so a cancelled request skips its best-effort accounting
+  row; `MetadataStorage.Store`'s cleanup defer was dead on `main` and
+  leaked `.tmp-*.json` on failure, now fixed with explicit removals; and
+  the `signing_key` validation error text gained `value too short: `;
+  the eviction loop's uncancellable context is deferred to #102 under a
+  `//nolint:contextcheck`; three `//nolint:tagliatelle` directives keep
   the snake_case JSON wire/disk formats unchanged; `make check` green
 - 2026-08-07 implement cache size management and eviction (closes
   #51): new `cache_max_bytes` config key validated by the startup

internal/signature/golden_test.go

@@ -111,7 +111,7 @@ func TestSigner_GoldenVectors(t *testing.T) {
 
 			gotPath, _, _ := signer.GenerateSignedURL(&urlReq, time.Hour)
 			if gotPath != tt.wantSignedPath {
-				t.Errorf("GenerateSignedURL() path = %q, want %q (layout changed?)",
+				t.Errorf("GenerateSignedURL() path = %q, want %q (signed URL layout changed?)",
 					gotPath, tt.wantSignedPath)
 			}
 		})