fix: resolve CI failures in docker build

- Install golangci-lint v2 via binary download instead of go install
  (avoids Go 1.25 requirement of golangci-lint v2.10+)
- Add darwin build tags to tests that depend on macOS keychain:
  derivation_index_test.go, pgpunlock_test.go, validation (keychain tests)
- Move generateRandomString to helpers_darwin.go (only called from
  darwin-only keychainunlocker.go)
- Fix unchecked error returns flagged by errcheck linter
- Add gnupg to builder stage for PGP-related tests
- Use --ulimit memlock=-1:-1 in CI for memguard large secret tests
- Add //nolint:unused for intentionally kept but currently unused test helpers

Dockerfile

@@ -6,7 +6,8 @@ RUN apk add --no-cache \
     gcc \
     musl-dev \
     make \
-    git
+    git \
+    gnupg
 
 # Set working directory
 WORKDIR /build
@@ -20,8 +21,8 @@ RUN go mod download
 # Copy source code
 COPY . .
 
-# Install golangci-lint for checks
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
+# Install golangci-lint for checks (binary install to avoid Go version constraints)
+RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.1.6
 
 # Run all checks (lint, vet, test, build)
 RUN make check