Update golangci-lint to v2.12.2 with canonical config (closes #30)

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

User-visible strings
--------------------

No user-visible string changes remain. Every error message this branch
composes is byte-identical to the one main composes.

The err113 sentinels are shaped so that fmt.Errorf reassembles the
original text around them: a sentinel carries the fixed words of the
message and the caller supplies the interpolated value in the position
it has always occupied. Where the value sits in the middle of the
sentence the sentinel therefore holds only a fragment (for example
vault.ErrVaultNotFound is "does not exist", composed by its caller as
"vault <name> does not exist"); each such sentinel documents the
message it participates in.

Verified mechanically rather than by inspection: every fmt.Errorf and
errors.New call site in both trees was parsed, the Error() text of any
sentinel passed to %w substituted in, and the resulting sets of
composed message templates compared. All 350 templates main produces
are still produced, character for character; the set of messages lost
or altered is empty.

unlocker list
-------------

findUnlockerIDByMetadata now returns (string, error) instead of
signalling failure with an empty ID. An unreadable unlockers.d is no
longer indistinguishable from "no matching entry", so UnlockersList
skips the entry with a warning naming the directory, as it did before
the scan was extracted into a helper, rather than emitting a row under
a synthesized fallback ID that no unlocker remove or unlocker select
can match and that suppresses the current-unlocker marker. The
duplicate-check and shell-completion callers skip on the same
condition, matching their pre-extraction behavior. Covered by tests in
internal/cli/unlockers_list_test.go.

internal/cli/secrets_size_test.go

@@ -1,3 +1,4 @@
+//nolint:testpackage // white-box test of unexported internals
 package cli
 
 import (
@@ -18,7 +19,144 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// testVaultName is the vault name used by the size tests.
+const testVaultName = "test-vault"
+
+// newSizeTestVault creates an in-memory vault unlocked with the test
+// mnemonic and returns the filesystem and vault.
+//
+//nolint:ireturn // afero.Fs is the filesystem abstraction used throughout
+func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
+	t.Helper()
+
+	fs := afero.NewMemMapFs()
+
+	// Set test mnemonic
+	t.Setenv(secret.EnvMnemonic, testMnemonic)
+
+	// Create vault
+	_, err := vault.CreateVault(fs, testStateDir, testVaultName)
+	require.NoError(t, err)
+
+	// Set current vault
+	currentVaultPath := filepath.Join(testStateDir, "currentvault")
+	vaultPath := filepath.Join(testStateDir, "vaults.d", testVaultName)
+	err = afero.WriteFile(fs, currentVaultPath, []byte(vaultPath), 0o600)
+	require.NoError(t, err)
+
+	// Get vault and set up long-term key
+	vlt, err := vault.GetCurrentVault(fs, testStateDir)
+	require.NoError(t, err)
+
+	ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
+	require.NoError(t, err)
+	vlt.Unlock(ltIdentity)
+
+	return fs, vlt
+}
+
+// runAddSecretSizeCase adds a secret of the given size through stdin and
+// verifies the outcome.
+func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+	t.Helper()
+
+	fs, vlt := newSizeTestVault(t)
+
+	// Generate test data of specified size
+	testData := make([]byte, size)
+	_, err := rand.Read(testData)
+	require.NoError(t, err)
+
+	// Add newline that will be stripped
+	testDataWithNewline := make([]byte, 0, len(testData)+1)
+	testDataWithNewline = append(testDataWithNewline, testData...)
+	testDataWithNewline = append(testDataWithNewline, '\n')
+
+	// Create command with fake stdin
+	cmd := &cobra.Command{}
+	cmd.SetIn(bytes.NewReader(testDataWithNewline))
+
+	// Create CLI instance
+	cli, err := NewCLIInstance()
+	if err != nil {
+		t.Fatalf("failed to initialize CLI: %v", err)
+	}
+
+	cli.fs = fs
+	cli.stateDir = testStateDir
+	cli.cmd = cmd
+
+	// Test adding the secret
+	secretName := fmt.Sprintf("test-secret-%d", size)
+	err = cli.AddSecret(secretName, false)
+
+	if wantErr {
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), errMsg)
+
+		return
+	}
+
+	require.NoError(t, err)
+
+	// Verify the secret was stored correctly
+	retrievedValue, err := vlt.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, testData, retrievedValue,
+		"Retrieved secret should match original (without newline)")
+}
+
+// runImportSecretSizeCase imports a secret file of the given size and
+// verifies the outcome.
+func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+	t.Helper()
+
+	fs, vlt := newSizeTestVault(t)
+
+	// Generate test data of specified size
+	testData := make([]byte, size)
+	_, err := rand.Read(testData)
+	require.NoError(t, err)
+
+	// Write test data to file
+	testFile := fmt.Sprintf("/test/secret-%d.bin", size)
+	err = afero.WriteFile(fs, testFile, testData, 0o600)
+	require.NoError(t, err)
+
+	// Create command
+	cmd := &cobra.Command{}
+
+	// Create CLI instance
+	cli, err := NewCLIInstance()
+	if err != nil {
+		t.Fatalf("failed to initialize CLI: %v", err)
+	}
+
+	cli.fs = fs
+	cli.stateDir = testStateDir
+
+	// Test importing the secret
+	secretName := fmt.Sprintf("imported-secret-%d", size)
+	err = cli.ImportSecret(cmd, secretName, testFile, false)
+
+	if wantErr {
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), errMsg)
+
+		return
+	}
+
+	require.NoError(t, err)
+
+	// Verify the secret was stored correctly
+	retrievedValue, err := vlt.GetSecret(secretName)
+	require.NoError(t, err)
+	assert.Equal(t, testData, retrievedValue, "Retrieved secret should match original")
+}
+
 // TestAddSecretVariousSizes tests adding secrets of various sizes through stdin
+//
+//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
 func TestAddSecretVariousSizes(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -71,76 +209,14 @@ func TestAddSecretVariousSizes(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Set up test environment
-			fs := afero.NewMemMapFs()
-			stateDir := "/test/state"
-
-			// Set test mnemonic
-			t.Setenv(secret.EnvMnemonic, "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about")
-
-			// Create vault
-			vaultName := "test-vault"
-			_, err := vault.CreateVault(fs, stateDir, vaultName)
-			require.NoError(t, err)
-
-			// Set current vault
-			currentVaultPath := filepath.Join(stateDir, "currentvault")
-			vaultPath := filepath.Join(stateDir, "vaults.d", vaultName)
-			err = afero.WriteFile(fs, currentVaultPath, []byte(vaultPath), 0o600)
-			require.NoError(t, err)
-
-			// Get vault and set up long-term key
-			vlt, err := vault.GetCurrentVault(fs, stateDir)
-			require.NoError(t, err)
-
-			ltIdentity, err := agehd.DeriveIdentity("abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about", 0)
-			require.NoError(t, err)
-			vlt.Unlock(ltIdentity)
-
-			// Generate test data of specified size
-			testData := make([]byte, tt.size)
-			_, err = rand.Read(testData)
-			require.NoError(t, err)
-
-			// Add newline that will be stripped
-			testDataWithNewline := append(testData, '\n')
-
-			// Create fake stdin
-			stdin := bytes.NewReader(testDataWithNewline)
-
-			// Create command with fake stdin
-			cmd := &cobra.Command{}
-			cmd.SetIn(stdin)
-
-			// Create CLI instance
-			cli, err := NewCLIInstance()
-			if err != nil {
-				t.Fatalf("failed to initialize CLI: %v", err)
-			}
-			cli.fs = fs
-			cli.stateDir = stateDir
-			cli.cmd = cmd
-
-			// Test adding the secret
-			secretName := fmt.Sprintf("test-secret-%d", tt.size)
-			err = cli.AddSecret(secretName, false)
-
-			if tt.shouldError {
-				assert.Error(t, err)
-				assert.Contains(t, err.Error(), tt.errorMsg)
-			} else {
-				require.NoError(t, err)
-
-				// Verify the secret was stored correctly
-				retrievedValue, err := vlt.GetSecret(secretName)
-				require.NoError(t, err)
-				assert.Equal(t, testData, retrievedValue, "Retrieved secret should match original (without newline)")
-			}
+			runAddSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
 		})
 	}
 }
 
 // TestImportSecretVariousSizes tests importing secrets of various sizes from files
+//
+//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
 func TestImportSecretVariousSizes(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -193,73 +269,14 @@ func TestImportSecretVariousSizes(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Set up test environment
-			fs := afero.NewMemMapFs()
-			stateDir := "/test/state"
-
-			// Set test mnemonic
-			t.Setenv(secret.EnvMnemonic, "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about")
-
-			// Create vault
-			vaultName := "test-vault"
-			_, err := vault.CreateVault(fs, stateDir, vaultName)
-			require.NoError(t, err)
-
-			// Set current vault
-			currentVaultPath := filepath.Join(stateDir, "currentvault")
-			vaultPath := filepath.Join(stateDir, "vaults.d", vaultName)
-			err = afero.WriteFile(fs, currentVaultPath, []byte(vaultPath), 0o600)
-			require.NoError(t, err)
-
-			// Get vault and set up long-term key
-			vlt, err := vault.GetCurrentVault(fs, stateDir)
-			require.NoError(t, err)
-
-			ltIdentity, err := agehd.DeriveIdentity("abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about", 0)
-			require.NoError(t, err)
-			vlt.Unlock(ltIdentity)
-
-			// Generate test data of specified size
-			testData := make([]byte, tt.size)
-			_, err = rand.Read(testData)
-			require.NoError(t, err)
-
-			// Write test data to file
-			testFile := fmt.Sprintf("/test/secret-%d.bin", tt.size)
-			err = afero.WriteFile(fs, testFile, testData, 0o600)
-			require.NoError(t, err)
-
-			// Create command
-			cmd := &cobra.Command{}
-
-			// Create CLI instance
-			cli, err := NewCLIInstance()
-			if err != nil {
-				t.Fatalf("failed to initialize CLI: %v", err)
-			}
-			cli.fs = fs
-			cli.stateDir = stateDir
-
-			// Test importing the secret
-			secretName := fmt.Sprintf("imported-secret-%d", tt.size)
-			err = cli.ImportSecret(cmd, secretName, testFile, false)
-
-			if tt.shouldError {
-				assert.Error(t, err)
-				assert.Contains(t, err.Error(), tt.errorMsg)
-			} else {
-				require.NoError(t, err)
-
-				// Verify the secret was stored correctly
-				retrievedValue, err := vlt.GetSecret(secretName)
-				require.NoError(t, err)
-				assert.Equal(t, testData, retrievedValue, "Retrieved secret should match original")
-			}
+			runImportSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
 		})
 	}
 }
 
 // TestAddSecretBufferGrowth tests that our buffer growth strategy works correctly
+//
+//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
 func TestAddSecretBufferGrowth(t *testing.T) {
 	// Test various sizes that should trigger buffer growth
 	sizes := []int{
@@ -283,31 +300,7 @@ func TestAddSecretBufferGrowth(t *testing.T) {
 
 	for _, size := range sizes {
 		t.Run(fmt.Sprintf("size_%d", size), func(t *testing.T) {
-			// Set up test environment
-			fs := afero.NewMemMapFs()
-			stateDir := "/test/state"
-
-			// Set test mnemonic
-			t.Setenv(secret.EnvMnemonic, "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about")
-
-			// Create vault
-			vaultName := "test-vault"
-			_, err := vault.CreateVault(fs, stateDir, vaultName)
-			require.NoError(t, err)
-
-			// Set current vault
-			currentVaultPath := filepath.Join(stateDir, "currentvault")
-			vaultPath := filepath.Join(stateDir, "vaults.d", vaultName)
-			err = afero.WriteFile(fs, currentVaultPath, []byte(vaultPath), 0o600)
-			require.NoError(t, err)
-
-			// Get vault and set up long-term key
-			vlt, err := vault.GetCurrentVault(fs, stateDir)
-			require.NoError(t, err)
-
-			ltIdentity, err := agehd.DeriveIdentity("abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about", 0)
-			require.NoError(t, err)
-			vlt.Unlock(ltIdentity)
+			fs, vlt := newSizeTestVault(t)
 
 			// Create test data of exactly the specified size
 			// Use a pattern that's easy to verify
@@ -316,20 +309,18 @@ func TestAddSecretBufferGrowth(t *testing.T) {
 				testData[i] = byte(i % 256)
 			}
 
-			// Create fake stdin without newline
-			stdin := bytes.NewReader(testData)
-
-			// Create command with fake stdin
+			// Create command with fake stdin (no newline)
 			cmd := &cobra.Command{}
-			cmd.SetIn(stdin)
+			cmd.SetIn(bytes.NewReader(testData))
 
 			// Create CLI instance
 			cli, err := NewCLIInstance()
 			if err != nil {
 				t.Fatalf("failed to initialize CLI: %v", err)
 			}
+
 			cli.fs = fs
-			cli.stateDir = stateDir
+			cli.stateDir = testStateDir
 			cli.cmd = cmd
 
 			// Test adding the secret
@@ -340,58 +331,38 @@ func TestAddSecretBufferGrowth(t *testing.T) {
 			// Verify the secret was stored correctly
 			retrievedValue, err := vlt.GetSecret(secretName)
 			require.NoError(t, err)
-			assert.Equal(t, testData, retrievedValue, "Retrieved secret should match original exactly")
+			assert.Equal(t, testData, retrievedValue,
+				"Retrieved secret should match original exactly")
 		})
 	}
 }
 
 // TestAddSecretStreamingBehavior tests that we handle streaming input correctly
+//
+//nolint:paralleltest // uses t.Setenv via newSizeTestVault
 func TestAddSecretStreamingBehavior(t *testing.T) {
-	// Set up test environment
-	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
-
-	// Set test mnemonic
-	t.Setenv(secret.EnvMnemonic, "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about")
-
-	// Create vault
-	vaultName := "test-vault"
-	_, err := vault.CreateVault(fs, stateDir, vaultName)
-	require.NoError(t, err)
-
-	// Set current vault
-	currentVaultPath := filepath.Join(stateDir, "currentvault")
-	vaultPath := filepath.Join(stateDir, "vaults.d", vaultName)
-	err = afero.WriteFile(fs, currentVaultPath, []byte(vaultPath), 0o600)
-	require.NoError(t, err)
-
-	// Get vault and set up long-term key
-	vlt, err := vault.GetCurrentVault(fs, stateDir)
-	require.NoError(t, err)
-
-	ltIdentity, err := agehd.DeriveIdentity("abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about", 0)
-	require.NoError(t, err)
-	vlt.Unlock(ltIdentity)
+	fs, vlt := newSizeTestVault(t)
 
 	// Create a custom reader that simulates slow streaming input
 	// This will help verify our buffer handling works correctly with partial reads
 	testData := []byte(strings.Repeat("Hello, World! ", 1000)) // ~14KB
-	slowReader := &slowReader{
+	streamingStdin := &slowReader{
 		data:      testData,
 		chunkSize: 1000, // Read 1KB at a time
 	}
 
 	// Create command with slow reader as stdin
 	cmd := &cobra.Command{}
-	cmd.SetIn(slowReader)
+	cmd.SetIn(streamingStdin)
 
 	// Create CLI instance
 	cli, err := NewCLIInstance()
 	if err != nil {
 		t.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cli.fs = fs
-	cli.stateDir = stateDir
+	cli.stateDir = testStateDir
 	cli.cmd = cmd
 
 	// Test adding the secret
@@ -411,27 +382,22 @@ type slowReader struct {
 	chunkSize int
 }
 
-func (r *slowReader) Read(p []byte) (n int, err error) {
+func (r *slowReader) Read(p []byte) (int, error) {
 	if r.offset >= len(r.data) {
 		return 0, io.EOF
 	}
 
-	// Read at most chunkSize bytes
+	// Read at most chunkSize bytes, bounded by the remaining data and
+	// the destination buffer
 	remaining := len(r.data) - r.offset
-	toRead := r.chunkSize
-	if toRead > remaining {
-		toRead = remaining
-	}
-	if toRead > len(p) {
-		toRead = len(p)
-	}
+	toRead := min(r.chunkSize, remaining, len(p))
 
-	n = copy(p, r.data[r.offset:r.offset+toRead])
+	n := copy(p, r.data[r.offset:r.offset+toRead])
 	r.offset += n
 
 	if r.offset >= len(r.data) {
-		err = io.EOF
+		return n, io.EOF
 	}
 
-	return n, err
+	return n, nil
 }