Update golangci-lint to v2.12.2 with canonical config

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

internal/vault/metadata.go

@@ -34,12 +34,15 @@ func ComputeDoubleSHA256(data []byte) string {
 
 // GetNextDerivationIndex finds the next available derivation index for a given mnemonic
 // by deriving the public key for index 0 and using its hash to identify related vaults
-func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonic string) (uint32, error) {
+func GetNextDerivationIndex(
+	fs afero.Fs, stateDir string, mnemonic string,
+) (uint32, error) {
 	// First, derive the public key for index 0 to get our identifier
 	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
 	if err != nil {
 		return 0, fmt.Errorf("failed to derive identity for index 0: %w", err)
 	}
+
 	pubKeyHash := ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
 
 	vaultsDir := filepath.Join(stateDir, "vaults.d")
@@ -49,6 +52,7 @@ func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonic string) (uint
 	if err != nil {
 		return 0, fmt.Errorf("failed to check if vaults directory exists: %w", err)
 	}
+
 	if !exists {
 		// No vaults yet, start with index 0
 		return 0, nil
@@ -70,6 +74,7 @@ func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonic string) (uint
 
 		// Try to read vault metadata
 		metadataPath := filepath.Join(vaultsDir, entry.Name(), "vault-metadata.json")
+
 		metadataBytes, err := afero.ReadFile(fs, metadataPath)
 		if err != nil {
 			// Skip vaults without metadata
@@ -77,7 +82,9 @@ func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonic string) (uint
 		}
 
 		var metadata Metadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
+
+		err = json.Unmarshal(metadataBytes, &metadata)
+		if err != nil {
 			// Skip vaults with invalid metadata
 			continue
 		}
@@ -106,7 +113,8 @@ func SaveVaultMetadata(fs afero.Fs, vaultDir string, metadata *Metadata) error {
 		return fmt.Errorf("failed to marshal vault metadata: %w", err)
 	}
 
-	if err := afero.WriteFile(fs, metadataPath, metadataBytes, secret.FilePerms); err != nil {
+	err = afero.WriteFile(fs, metadataPath, metadataBytes, secret.FilePerms)
+	if err != nil {
 		return fmt.Errorf("failed to write vault metadata: %w", err)
 	}
 
@@ -123,7 +131,9 @@ func LoadVaultMetadata(fs afero.Fs, vaultDir string) (*Metadata, error) {
 	}
 
 	var metadata Metadata
-	if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
+
+	err = json.Unmarshal(metadataBytes, &metadata)
+	if err != nil {
 		return nil, fmt.Errorf("failed to unmarshal vault metadata: %w", err)
 	}