Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/vault/errors.go

@@ -0,0 +1,53 @@
+package vault
+
+import "errors"
+
+// Sentinel errors returned by vault operations.
+var (
+	// ErrMnemonicMismatch indicates the mnemonic-derived public key does
+	// not match the vault's stored public key hash.
+	ErrMnemonicMismatch = errors.New(
+		"derived public key does not match vault: mnemonic may be incorrect",
+	)
+
+	// ErrInvalidVaultName indicates a vault name that does not match the
+	// allowed pattern [a-z0-9.\-_]+.
+	ErrInvalidVaultName = errors.New(
+		"invalid vault name: must match pattern [a-z0-9.\\-_]+",
+	)
+
+	// ErrVaultNotFound indicates the named vault does not exist.
+	ErrVaultNotFound = errors.New("vault does not exist")
+
+	// ErrNilValueBuffer indicates a nil value buffer was supplied.
+	ErrNilValueBuffer = errors.New("value buffer is nil")
+
+	// ErrInvalidSecretName indicates a secret name that does not match
+	// the allowed pattern [a-z0-9.\-_/]+.
+	ErrInvalidSecretName = errors.New(
+		"invalid secret name: must match pattern [a-z0-9.\\-_/]+",
+	)
+
+	// ErrSecretExists indicates the secret already exists and --force
+	// was not supplied.
+	ErrSecretExists = errors.New(
+		"secret already exists (use --force to overwrite)",
+	)
+
+	// ErrSecretNotFound indicates the named secret does not exist.
+	ErrSecretNotFound = errors.New("secret not found")
+
+	// ErrVersionNotFound indicates the requested secret version does not
+	// exist.
+	ErrVersionNotFound = errors.New("version not found")
+
+	// ErrNoVersions indicates the source secret has no versions.
+	ErrNoVersions = errors.New("source secret has no versions")
+
+	// ErrUnsupportedUnlockerType indicates an unlocker metadata type
+	// that this build does not support.
+	ErrUnsupportedUnlockerType = errors.New("unsupported unlocker type")
+
+	// ErrUnlockerNotFound indicates no unlocker with the given ID exists.
+	ErrUnlockerNotFound = errors.New("unlocker not found")
+)