Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/cli/generate.go

@@ -2,6 +2,7 @@ package cli
 
 import (
 	"crypto/rand"
+	"errors"
 	"fmt"
 	"math/big"
 	"os"
@@ -17,6 +18,16 @@ const (
 	mnemonicEntropyBits = 128
 )
 
+// Sentinel errors for secret generation
+var (
+	errLengthTooSmall           = errors.New("length must be at least 1")
+	errLengthNotPositive        = errors.New("length must be positive")
+	errMnemonicTypeNotSupported = errors.New(
+		"mnemonic type not supported for secret generation, " +
+			"use 'secret generate mnemonic' instead")
+	errUnsupportedSecretType = errors.New("unsupported type")
+)
+
 func newGenerateCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "generate",
@@ -52,8 +63,9 @@ func newGenerateSecretCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "secret <name>",
 		Short: "Generate a random secret and store it in the vault",
-		Long:  `Generate a cryptographically secure random secret and store it in the current vault under the given name.`,
-		Args:  cobra.ExactArgs(1),
+		Long: `Generate a cryptographically secure random secret and ` +
+			`store it in the current vault under the given name.`,
+		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			length, _ := cmd.Flags().GetInt("length")
 			secretType, _ := cmd.Flags().GetString("type")
@@ -68,8 +80,10 @@ func newGenerateSecretCmd() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().IntP("length", "l", defaultSecretLength, "Length of the generated secret (default 16)")
-	cmd.Flags().StringP("type", "t", "base58", "Type of secret to generate (base58, alnum)")
+	cmd.Flags().IntP("length", "l", defaultSecretLength,
+		"Length of the generated secret (default 16)")
+	cmd.Flags().StringP("type", "t", "base58",
+		"Type of secret to generate (base58, alnum)")
 	cmd.Flags().BoolP("force", "f", false, "Overwrite existing secret")
 
 	return cmd
@@ -98,7 +112,8 @@ func (cli *Instance) GenerateMnemonic(cmd *cobra.Command) error {
 	fmt.Fprintln(os.Stderr, "   • Write it down on paper and store it safely")
 	fmt.Fprintln(os.Stderr, "   • Do not store it digitally or share it with anyone")
 	fmt.Fprintln(os.Stderr, "   • You will need this phrase to recover your secrets")
-	fmt.Fprintln(os.Stderr, "   • If you lose this phrase, your secrets cannot be recovered")
+	fmt.Fprintln(os.Stderr,
+		"   • If you lose this phrase, your secrets cannot be recovered")
 	fmt.Fprintln(os.Stderr, "")
 	fmt.Fprintln(os.Stderr, "Use this mnemonic with:")
 	fmt.Fprintln(os.Stderr, "   secret init    (to initialize a new secret manager)")
@@ -116,11 +131,13 @@ func (cli *Instance) GenerateSecret(
 	force bool,
 ) error {
 	if length < 1 {
-		return fmt.Errorf("length must be at least 1")
+		return errLengthTooSmall
 	}
 
-	var secretValue string
-	var err error
+	var (
+		secretValue string
+		err         error
+	)
 
 	switch secretType {
 	case "base58":
@@ -128,9 +145,10 @@ func (cli *Instance) GenerateSecret(
 	case "alnum":
 		secretValue, err = generateRandomAlnum(length)
 	case "mnemonic":
-		return fmt.Errorf("mnemonic type not supported for secret generation, use 'secret generate mnemonic' instead")
+		return errMnemonicTypeNotSupported
 	default:
-		return fmt.Errorf("unsupported type: %s (supported: base58, alnum)", secretType)
+		return fmt.Errorf("%w: %s (supported: base58, alnum)",
+			errUnsupportedSecretType, secretType)
 	}
 
 	if err != nil {
@@ -147,11 +165,13 @@ func (cli *Instance) GenerateSecret(
 	secretBuffer := memguard.NewBufferFromBytes([]byte(secretValue))
 	defer secretBuffer.Destroy()
 
-	if err := vlt.AddSecret(secretName, secretBuffer, force); err != nil {
+	err = vlt.AddSecret(secretName, secretBuffer, force)
+	if err != nil {
 		return err
 	}
 
-	cmd.Printf("Generated and stored %d-character %s secret: %s\n", length, secretType, secretName)
+	cmd.Printf("Generated and stored %d-character %s secret: %s\n",
+		length, secretType, secretName)
 
 	return nil
 }
@@ -170,10 +190,11 @@ func generateRandomAlnum(length int) (string, error) {
 	return generateRandomString(length, alnumChars)
 }
 
-// generateRandomString generates a random string of the specified length using the given character set
+// generateRandomString generates a random string of the specified length
+// using the given character set
 func generateRandomString(length int, charset string) (string, error) {
 	if length <= 0 {
-		return "", fmt.Errorf("length must be positive")
+		return "", errLengthNotPositive
 	}
 
 	result := make([]byte, length)
@@ -184,6 +205,7 @@ func generateRandomString(length int, charset string) (string, error) {
 		if err != nil {
 			return "", fmt.Errorf("failed to generate random number: %w", err)
 		}
+
 		result[i] = charset[randomIndex.Int64()]
 	}