Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/secret/debug.go

@@ -13,28 +13,33 @@ import (
 )
 
 var (
-	debugEnabled bool         //nolint:gochecknoglobals // Package-wide debug state is necessary
-	debugLogger  *slog.Logger //nolint:gochecknoglobals // Package-wide logger instance is necessary
+	debugEnabled bool         //nolint:gochecknoglobals // package debug state
+	debugLogger  *slog.Logger //nolint:gochecknoglobals // package debug logger
 )
 
+//nolint:gochecknoinits // debug logging must be ready before any package use
 func init() {
 	InitDebugLogging()
 }
 
-// InitDebugLogging initializes the debug logging system based on current GODEBUG environment variable
+// InitDebugLogging initializes the debug logging system based on the
+// current GODEBUG environment variable
 func InitDebugLogging() {
 	godebug := os.Getenv("GODEBUG")
 	debugEnabled = strings.Contains(godebug, "berlin.sneak.pkg.secret")
 
 	if !debugEnabled {
 		// Create a no-op logger that discards all output
-		debugLogger = slog.New(slog.NewTextHandler(io.Discard, nil))
+		debugLogger = slog.New(slog.DiscardHandler)
 
 		return
 	}
 
-	// Disable stderr buffering for immediate debug output when debugging is enabled
-	_, _, _ = syscall.Syscall(syscall.SYS_FCNTL, os.Stderr.Fd(), syscall.F_SETFL, syscall.O_SYNC)
+	// Disable stderr buffering for immediate debug output when
+	// debugging is enabled
+	//nolint:dogsled // syscall.Syscall returns three values, none needed
+	_, _, _ = syscall.Syscall(
+		syscall.SYS_FCNTL, os.Stderr.Fd(), syscall.F_SETFL, syscall.O_SYNC)
 
 	// Check if STDERR is a TTY
 	isTTY := term.IsTerminal(syscall.Stderr)
@@ -58,14 +63,19 @@ func IsDebugEnabled() bool {
 	return debugEnabled
 }
 
-// Warn logs a warning message to stderr unconditionally (visible without --verbose or debug flags)
+// Warn logs a warning message to stderr unconditionally (visible
+// without --verbose or debug flags)
 func Warn(msg string, args ...any) {
-	output := fmt.Sprintf("WARNING: %s", msg)
+	var output strings.Builder
+
+	output.WriteString("WARNING: " + msg)
+
 	for i := 0; i+1 < len(args); i += 2 {
-		output += fmt.Sprintf(" %s=%v", args[i], args[i+1])
+		fmt.Fprintf(&output, " %s=%v", args[i], args[i+1])
 	}
-	output += "\n"
-	fmt.Fprint(os.Stderr, output)
+
+	output.WriteString("\n")
+	fmt.Fprint(os.Stderr, output.String())
 }
 
 // Debug logs a debug message with optional attributes
@@ -73,14 +83,16 @@ func Debug(msg string, args ...any) {
 	if !debugEnabled {
 		return
 	}
+
 	debugLogger.Debug(msg, args...)
 }
 
-// DebugF logs a formatted debug message with optional attributes
-func DebugF(format string, args ...any) {
+// Debugf logs a formatted debug message with optional attributes
+func Debugf(format string, args ...any) {
 	if !debugEnabled {
 		return
 	}
+
 	debugLogger.Debug(fmt.Sprintf(format, args...))
 }
 
@@ -89,6 +101,7 @@ func DebugWith(msg string, attrs ...slog.Attr) {
 	if !debugEnabled {
 		return
 	}
+
 	debugLogger.LogAttrs(context.Background(), slog.LevelDebug, msg, attrs...)
 }
 
@@ -118,15 +131,18 @@ func (h *colorizedHandler) Handle(_ context.Context, record slog.Record) error {
 	if record.NumAttrs() > 0 {
 		output += " \033[33m{"
 		first := true
+
 		record.Attrs(func(attr slog.Attr) bool {
 			if !first {
 				output += ", "
 			}
+
 			first = false
 			output += fmt.Sprintf("%s=%#v", attr.Key, attr.Value.Any())
 
 			return true
 		})
+
 		output += "}\033[0m"
 	}