fix: resolve CI failures in docker build

- Install golangci-lint v2 via binary download instead of go install
  (avoids Go 1.25 requirement of golangci-lint v2.10+)
- Add darwin build tags to tests that depend on macOS keychain:
  derivation_index_test.go, pgpunlock_test.go, validation (keychain tests)
- Move generateRandomString to helpers_darwin.go (only called from
  darwin-only keychainunlocker.go)
- Fix unchecked error returns flagged by errcheck linter
- Add gnupg to builder stage for PGP-related tests
- Use --ulimit memlock=-1:-1 in CI for memguard large secret tests
- Add //nolint:unused for intentionally kept but currently unused test helpers

.gitea/workflows/check.yml

@@ -13,4 +13,4 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13925f8d5 # v4
 
       - name: Build (includes make check)
-        run: docker build .
+        run: docker build --ulimit memlock=-1:-1 .