Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/cli/info_helper.go

@@ -8,81 +8,115 @@ import (
 	"github.com/spf13/afero"
 )
 
-// gatherVaultStats collects statistics from all vaults
+// vaultStats accumulates statistics while walking vault directories
+type vaultStats struct {
+	totalSecrets int
+	totalSize    int64
+	oldestTime   time.Time
+	latestTime   time.Time
+}
+
+// addVersion accumulates size and timestamp info for one version directory
+func (s *vaultStats) addVersion(fs afero.Fs, versionPath string) {
+	// Add size of encrypted data
+	dataPath := filepath.Join(versionPath, "data.age")
+
+	stat, err := fs.Stat(dataPath)
+	if err == nil {
+		s.totalSize += stat.Size()
+	}
+
+	// Add size of metadata
+	metaPath := filepath.Join(versionPath, "metadata.age")
+
+	stat, err = fs.Stat(metaPath)
+	if err == nil {
+		s.totalSize += stat.Size()
+	}
+
+	// Track timestamps
+	stat, err = fs.Stat(versionPath)
+	if err == nil {
+		modTime := stat.ModTime()
+		if s.oldestTime.IsZero() || modTime.Before(s.oldestTime) {
+			s.oldestTime = modTime
+		}
+
+		if s.latestTime.IsZero() || modTime.After(s.latestTime) {
+			s.latestTime = modTime
+		}
+	}
+}
+
+// addSecret accumulates stats for one secret directory
+func (s *vaultStats) addSecret(fs afero.Fs, secretsPath, secretName string) {
+	s.totalSecrets++
+	secretPath := filepath.Join(secretsPath, secretName)
+
+	// Get size and timestamps from all versions
+	versionsPath := filepath.Join(secretPath, "versions")
+
+	versionEntries, err := afero.ReadDir(fs, versionsPath)
+	if err != nil {
+		secret.Warn("Could not read versions directory for secret",
+			"secret", secretName, "error", err)
+
+		return
+	}
+
+	for _, versionEntry := range versionEntries {
+		if !versionEntry.IsDir() {
+			continue
+		}
+
+		s.addVersion(fs, filepath.Join(versionsPath, versionEntry.Name()))
+	}
+}
+
+// addVault accumulates stats for one vault directory
+func (s *vaultStats) addVault(fs afero.Fs, vaultsDir, vaultName string) {
+	vaultPath := filepath.Join(vaultsDir, vaultName)
+	secretsPath := filepath.Join(vaultPath, "secrets.d")
+
+	// Count secrets in this vault
+	secretEntries, err := afero.ReadDir(fs, secretsPath)
+	if err != nil {
+		secret.Warn("Could not read secrets directory for vault",
+			"vault", vaultName, "error", err)
+
+		return
+	}
+
+	for _, secretEntry := range secretEntries {
+		if !secretEntry.IsDir() {
+			continue
+		}
+
+		s.addSecret(fs, secretsPath, secretEntry.Name())
+	}
+}
+
+// gatherVaultStats collects statistics from all vaults, returning the
+// total secret count, total size, and oldest/latest secret timestamps
 func gatherVaultStats(
 	fs afero.Fs,
 	vaultsDir string,
-) (totalSecrets int, totalSize int64, oldestTime, latestTime time.Time, err error) {
+) (int, int64, time.Time, time.Time, error) {
 	vaultEntries, err := afero.ReadDir(fs, vaultsDir)
 	if err != nil {
 		return 0, 0, time.Time{}, time.Time{}, err
 	}
 
+	var stats vaultStats
+
 	for _, vaultEntry := range vaultEntries {
 		if !vaultEntry.IsDir() {
 			continue
 		}
 
-		vaultPath := filepath.Join(vaultsDir, vaultEntry.Name())
-		secretsPath := filepath.Join(vaultPath, "secrets.d")
-
-		// Count secrets in this vault
-		secretEntries, err := afero.ReadDir(fs, secretsPath)
-		if err != nil {
-			secret.Warn("Could not read secrets directory for vault", "vault", vaultEntry.Name(), "error", err)
-
-			continue
-		}
-
-		for _, secretEntry := range secretEntries {
-			if !secretEntry.IsDir() {
-				continue
-			}
-
-			totalSecrets++
-			secretPath := filepath.Join(secretsPath, secretEntry.Name())
-
-			// Get size and timestamps from all versions
-			versionsPath := filepath.Join(secretPath, "versions")
-			versionEntries, err := afero.ReadDir(fs, versionsPath)
-			if err != nil {
-				secret.Warn("Could not read versions directory for secret", "secret", secretEntry.Name(), "error", err)
-
-				continue
-			}
-
-			for _, versionEntry := range versionEntries {
-				if !versionEntry.IsDir() {
-					continue
-				}
-
-				versionPath := filepath.Join(versionsPath, versionEntry.Name())
-
-				// Add size of encrypted data
-				dataPath := filepath.Join(versionPath, "data.age")
-				if stat, err := fs.Stat(dataPath); err == nil {
-					totalSize += stat.Size()
-				}
-
-				// Add size of metadata
-				metaPath := filepath.Join(versionPath, "metadata.age")
-				if stat, err := fs.Stat(metaPath); err == nil {
-					totalSize += stat.Size()
-				}
-
-				// Track timestamps
-				if stat, err := fs.Stat(versionPath); err == nil {
-					modTime := stat.ModTime()
-					if oldestTime.IsZero() || modTime.Before(oldestTime) {
-						oldestTime = modTime
-					}
-					if latestTime.IsZero() || modTime.After(latestTime) {
-						latestTime = modTime
-					}
-				}
-			}
-		}
+		stats.addVault(fs, vaultsDir, vaultEntry.Name())
 	}
 
-	return totalSecrets, totalSize, oldestTime, latestTime, nil
+	return stats.totalSecrets, stats.totalSize,
+		stats.oldestTime, stats.latestTime, nil
 }