Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/secret/validation_test.go

@@ -1,3 +1,4 @@
+//nolint:testpackage // white-box test of unexported internals
 package secret
 
 import (
@@ -5,148 +6,60 @@ import (
 )
 
 func TestValidateGPGKeyID(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		keyID   string
 		wantErr bool
 	}{
 		// Valid cases
+		{"valid email address", "test@example.com", false},
+		{"valid email with dots and hyphens", "test.user-name@example-domain.co.uk", false},
+		{"valid email with plus", "test+tag@example.com", false},
+		{"valid short key ID (8 hex chars)", "ABCDEF12", false},
+		{"valid long key ID (16 hex chars)", "ABCDEF1234567890", false},
 		{
-			name:    "valid email address",
-			keyID:   "test@example.com",
-			wantErr: false,
+			"valid fingerprint (40 hex chars)",
+			"ABCDEF1234567890ABCDEF1234567890ABCDEF12", false,
 		},
 		{
-			name:    "valid email with dots and hyphens",
-			keyID:   "test.user-name@example-domain.co.uk",
-			wantErr: false,
-		},
-		{
-			name:    "valid email with plus",
-			keyID:   "test+tag@example.com",
-			wantErr: false,
-		},
-		{
-			name:    "valid short key ID (8 hex chars)",
-			keyID:   "ABCDEF12",
-			wantErr: false,
-		},
-		{
-			name:    "valid long key ID (16 hex chars)",
-			keyID:   "ABCDEF1234567890",
-			wantErr: false,
-		},
-		{
-			name:    "valid fingerprint (40 hex chars)",
-			keyID:   "ABCDEF1234567890ABCDEF1234567890ABCDEF12",
-			wantErr: false,
-		},
-		{
-			name:    "valid lowercase hex fingerprint",
-			keyID:   "abcdef1234567890abcdef1234567890abcdef12",
-			wantErr: false,
-		},
-		{
-			name:    "valid mixed case hex",
-			keyID:   "AbCdEf1234567890",
-			wantErr: false,
+			"valid lowercase hex fingerprint",
+			"abcdef1234567890abcdef1234567890abcdef12", false,
 		},
+		{"valid mixed case hex", "AbCdEf1234567890", false},
 
 		// Invalid cases
+		{"empty key ID", "", true},
+		{"key ID with spaces", "test user@example.com", true},
+		{"key ID with semicolon (command injection)", "test@example.com; rm -rf /", true},
 		{
-			name:    "empty key ID",
-			keyID:   "",
-			wantErr: true,
+			"key ID with pipe (command injection)",
+			"test@example.com | cat /etc/passwd", true,
 		},
+		{"key ID with backticks (command injection)", "test@example.com`whoami`", true},
 		{
-			name:    "key ID with spaces",
-			keyID:   "test user@example.com",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with semicolon (command injection)",
-			keyID:   "test@example.com; rm -rf /",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with pipe (command injection)",
-			keyID:   "test@example.com | cat /etc/passwd",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with backticks (command injection)",
-			keyID:   "test@example.com`whoami`",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with dollar sign (command injection)",
-			keyID:   "test@example.com$(whoami)",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with quotes",
-			keyID:   "test\"@example.com",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with single quotes",
-			keyID:   "test'@example.com",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with backslash",
-			keyID:   "test\\@example.com",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with newline",
-			keyID:   "test@example.com\nrm -rf /",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with carriage return",
-			keyID:   "test@example.com\rrm -rf /",
-			wantErr: true,
-		},
-		{
-			name:    "hex with invalid length (7 chars)",
-			keyID:   "ABCDEF1",
-			wantErr: true,
-		},
-		{
-			name:    "hex with invalid length (9 chars)",
-			keyID:   "ABCDEF123",
-			wantErr: true,
-		},
-		{
-			name:    "hex with non-hex characters",
-			keyID:   "ABCDEFGH",
-			wantErr: true,
-		},
-		{
-			name:    "mixed format (email with hex)",
-			keyID:   "test@ABCDEF12",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with ampersand",
-			keyID:   "test@example.com & echo test",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with redirect",
-			keyID:   "test@example.com > /tmp/test",
-			wantErr: true,
-		},
-		{
-			name:    "key ID with null byte",
-			keyID:   "test@example.com\x00",
-			wantErr: true,
+			"key ID with dollar sign (command injection)",
+			"test@example.com$(whoami)", true,
 		},
+		{"key ID with quotes", "test\"@example.com", true},
+		{"key ID with single quotes", "test'@example.com", true},
+		{"key ID with backslash", "test\\@example.com", true},
+		{"key ID with newline", "test@example.com\nrm -rf /", true},
+		{"key ID with carriage return", "test@example.com\rrm -rf /", true},
+		{"hex with invalid length (7 chars)", "ABCDEF1", true},
+		{"hex with invalid length (9 chars)", "ABCDEF123", true},
+		{"hex with non-hex characters", "ABCDEFGH", true},
+		{"mixed format (email with hex)", "test@ABCDEF12", true},
+		{"key ID with ampersand", "test@example.com & echo test", true},
+		{"key ID with redirect", "test@example.com > /tmp/test", true},
+		{"key ID with null byte", "test@example.com\x00", true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			err := validateGPGKeyID(tt.keyID)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("validateGPGKeyID() error = %v, wantErr %v", err, tt.wantErr)