Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/cli/root.go

@@ -10,17 +10,21 @@ import (
 // Entry is the entry point for the secret CLI application
 func Entry() {
 	cmd := newRootCmd()
-	if err := cmd.Execute(); err != nil {
+
+	err := cmd.Execute()
+	if err != nil {
 		os.Exit(1)
 	}
 }
 
 func newRootCmd() *cobra.Command {
 	secret.Debug("newRootCmd starting")
+
 	cmd := &cobra.Command{
 		Use:   "secret",
 		Short: "A simple secrets manager",
-		Long:  `A simple secrets manager to store and retrieve sensitive information securely.`,
+		Long: `A simple secrets manager to store and retrieve sensitive ` +
+			`information securely.`,
 		// Ensure usage is shown after errors
 		SilenceUsage:  false,
 		SilenceErrors: false,