policy: record canonical golangci-lint version v2.12.2 in REPO_POLICIES.md

The canonical config now targets golangci-lint v2.12.2 (released
2026-05-06), installed commit-pinned via go install at
c0d3ddc9cf3faa61a4e378e879ece580256d76e5. Record that version next to
the .golangci.yml fetch instructions so consuming repos pin the same
linter the canonical config is written for, and bump last_modified.

TODO.md

@@ -25,7 +25,8 @@ fmt-check, and commit.
   schema via `golangci-lint migrate` under v2.12.2 (settings under
   `linters.settings`, explicit `exclusions` and `formatters` blocks,
   `gomodguard` disabled in favor of `gomodguard_v2`; `gci` intentionally not
-  enabled).
+  enabled). Recorded the canonical golangci-lint version (v2.12.2,
+  commit-pinned) in REPO_POLICIES.md.
 - 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
   styleguide.
 - 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-08-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -260,7 +260,10 @@ style conventions are in separate documents:
 
 - `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
   manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
+  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
+  commit-pinned via
+  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).