Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/macse/macse_stub.go

@@ -1,12 +1,11 @@
 //go:build !darwin
-// +build !darwin
 
 // Package macse provides Go bindings for macOS Secure Enclave operations.
 package macse
 
-import "fmt"
+import "errors"
 
-var errNotSupported = fmt.Errorf("secure enclave is only supported on macOS") //nolint:gochecknoglobals
+var errNotSupported = errors.New("secure enclave is only supported on macOS")
 
 // CreateKey is not supported on non-darwin platforms.
 func CreateKey(_ string) ([]byte, string, error) {