Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

TODO.md

@@ -25,6 +25,14 @@ Bring the repo into policy compliance in one commit:
 
 # Completed Steps
 
+- 2026-08-07: Updated golangci-lint to v2.12.2 with the canonical
+  `.golangci.yml` (all linters enabled minus the standard disable
+  list, `lll` 88, tests linted); bumped the `Dockerfile` lint-stage
+  image to the tagged v2.12.2 Debian digest; fixed all ~1550 new
+  findings across `internal/` and `pkg/` (line wrapping, `wsl_v5`
+  blank lines, sentinel errors for `err113`, `t.Parallel()` where
+  safe, `_test` package conversions, complexity/`dupl` helper
+  extraction) on branch `golangci-v2.12.2`.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-11: Secure Enclave unlocker for hardware-backed secret
@@ -50,6 +58,17 @@ Bring the repo into policy compliance in one commit:
 
 - Compliance (after Next Step lands): keep main green under the new
   .gitea workflow; run make check before every merge.
+- Implement version-number shell completion for the second arg of
+  `secret version promote` and `secret version rm`
+  (`internal/cli/version.go`; was an in-code TODO removed for godox).
+- Cover mnemonic-vs-xprv identity consistency in
+  `pkg/agehd/agehd_test.go` `TestMnemonicVsXPRVConsistency` (was an
+  in-code FIXME removed for godox).
+- Darwin-gated files (`internal/secret/keychainunlocker.go`,
+  `seunlocker_darwin.go`, `internal/macse/macse_darwin.go`, related
+  tests) are not linted on the Linux CI runner and still contain lines
+  over the new 88-column limit; they will surface if lint ever runs on
+  macOS.
 - Merge secure-enclave-unlocker to main once review is done.
 - 1.0 critical security blockers (from repo TODO.md):
     - Command injection: GPG key IDs passed unescaped to exec.Command