Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/cli/test_helpers.go

@@ -9,7 +9,9 @@ import (
 )
 
 // ExecuteCommandInProcess executes a CLI command in-process for testing
-func ExecuteCommandInProcess(args []string, stdin string, env map[string]string) (string, error) {
+func ExecuteCommandInProcess(
+	args []string, stdin string, env map[string]string,
+) (string, error) {
 	secret.Debug("ExecuteCommandInProcess called", "args", args)
 
 	// Save current environment
@@ -43,11 +45,13 @@ func ExecuteCommandInProcess(args []string, stdin string, env map[string]string)
 	err := rootCmd.Execute()
 
 	output := buf.String()
-	secret.Debug("Command execution completed", "error", err, "outputLength", len(output), "output", output)
+	secret.Debug("Command execution completed",
+		"error", err, "outputLength", len(output), "output", output)
 
 	// Add debug info for troubleshooting
 	if len(output) == 0 && err == nil {
-		secret.Debug("Warning: Command executed successfully but produced no output", "args", args)
+		secret.Debug("Warning: Command executed successfully but produced no output",
+			"args", args)
 	}
 
 	// Restore environment