Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/cli/cli.go

@@ -19,6 +19,7 @@ type Instance struct {
 // NewCLIInstance creates a new CLI instance with the real filesystem
 func NewCLIInstance() (*Instance, error) {
 	fs := afero.NewOsFs()
+
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
 		return nil, fmt.Errorf("cannot determine state directory: %w", err)
@@ -30,7 +31,8 @@ func NewCLIInstance() (*Instance, error) {
 	}, nil
 }
 
-// NewCLIInstanceWithFs creates a new CLI instance with the given filesystem (for testing)
+// NewCLIInstanceWithFs creates a new CLI instance with the given
+// filesystem (for testing)
 func NewCLIInstanceWithFs(fs afero.Fs) (*Instance, error) {
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
@@ -43,7 +45,8 @@ func NewCLIInstanceWithFs(fs afero.Fs) (*Instance, error) {
 	}, nil
 }
 
-// NewCLIInstanceWithStateDir creates a new CLI instance with custom state directory (for testing)
+// NewCLIInstanceWithStateDir creates a new CLI instance with custom state
+// directory (for testing)
 func NewCLIInstanceWithStateDir(fs afero.Fs, stateDir string) *Instance {
 	return &Instance{
 		fs:       fs,
@@ -67,6 +70,6 @@ func (cli *Instance) GetStateDir() string {
 }
 
 // Print outputs to the command's configured output writer
-func (cli *Instance) Print(a ...interface{}) (n int, err error) {
+func (cli *Instance) Print(a ...any) (int, error) {
 	return fmt.Fprint(cli.cmd.OutOrStdout(), a...)
 }