Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/cli/cli_test.go

@@ -1,37 +1,43 @@
-package cli
+package cli_test
 
 import (
 	"os"
 	"path/filepath"
 	"testing"
 
+	"git.eeqj.de/sneak/secret/internal/cli"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"github.com/spf13/afero"
 )
 
 func TestCLIInstanceStateDir(t *testing.T) {
+	t.Parallel()
+
 	// Test the CLI instance state directory functionality
 	fs := afero.NewMemMapFs()
 
 	// Create a test state directory
 	testStateDir := "/test-state-dir"
-	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
+	instance := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
 
-	if cli.GetStateDir() != testStateDir {
-		t.Errorf("Expected state directory %q, got %q", testStateDir, cli.GetStateDir())
+	got := instance.GetStateDir()
+	if got != testStateDir {
+		t.Errorf("Expected state directory %q, got %q", testStateDir, got)
 	}
 }
 
+//nolint:paralleltest // reads process environment to determine the state dir
 func TestCLIInstanceWithFs(t *testing.T) {
 	// Test creating CLI instance with custom filesystem
 	fs := afero.NewMemMapFs()
-	cli, err := NewCLIInstanceWithFs(fs)
+
+	instance, err := cli.NewCLIInstanceWithFs(fs)
 	if err != nil {
 		t.Fatalf("failed to initialize CLI: %v", err)
 	}
 
 	// The state directory should be determined automatically
-	stateDir := cli.GetStateDir()
+	stateDir := instance.GetStateDir()
 	if stateDir == "" {
 		t.Error("Expected non-empty state directory")
 	}
@@ -48,6 +54,7 @@ func TestDetermineStateDir(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
+
 	if stateDir != testEnvDir {
 		t.Errorf("Expected state directory %q from environment, got %q", testEnvDir, stateDir)
 	}
@@ -55,12 +62,15 @@ func TestDetermineStateDir(t *testing.T) {
 	// Test with custom config dir
 	_ = os.Unsetenv(secret.EnvStateDir)
 	customConfigDir := "/custom-config"
+
 	stateDir, err = secret.DetermineStateDir(customConfigDir)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
+
 	expectedDir := filepath.Join(customConfigDir, secret.AppID)
 	if stateDir != expectedDir {
-		t.Errorf("Expected state directory %q with custom config, got %q", expectedDir, stateDir)
+		t.Errorf("Expected state directory %q with custom config, got %q",
+			expectedDir, stateDir)
 	}
 }