Update golangci-lint to v2.12.2 with canonical config

Bump the pinned golangci-lint from v2.12.1 to v2.12.2 in the
Dockerfile lint stage (tagged, digest-pinned Debian image) and in
script/bootstrap (go install ref). Replace .golangci.yml with the
canonical config: linter settings (lll, funlen, cyclop, dupl) move
under linters.settings per the v2 schema so they are actually
applied, and the redundant issues.exclude-use-default key is
dropped. No new lint findings surfaced; make check is green.

.golangci.yml

@@ -1,5 +1,9 @@
 version: "2"
 
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -14,8 +18,7 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-
-linters-settings:
+  settings:
     lll:
       line-length: 88
     funlen:
@@ -27,6 +30,5 @@ linters-settings:
       threshold: 100
 
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,6 +1,6 @@
 # Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.12.1, 2026-07-23
-FROM golangci/golangci-lint@sha256:c9843d374ca80ecbac86081ec4dd7fe2bb6187b03224f59a0cc2f80759e1845b AS lint
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

TODO.md

@@ -19,6 +19,13 @@
 
 # Completed Steps
 
+- update golangci-lint to v2.12.2 with the canonical config
+  (2026-08-07, branch `golangci-v2.12.2`): bumped the pinned linter
+  in the `Dockerfile` lint stage and `script/bootstrap` from v2.12.1
+  to v2.12.2, and replaced `.golangci.yml` with the canonical file —
+  the linter settings (`lll`, `funlen`, `cyclop`, `dupl` thresholds)
+  now live under `linters.settings` per the v2 schema, so they are
+  actually applied; no new lint findings surfaced
 - make the binary the default Make target (2026-07-24, branch
   `make-default-target`): plain `make` now builds `sfdupes`
   (previously it ran `check` plus `build`); `make build` remains as

script/bootstrap

@@ -9,9 +9,9 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-07-25 (same version as the Dockerfile lint stage).
-# golangci-lint v2.12.1
-GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.1"
+# Pinned versions, 2026-08-07 (same version as the Dockerfile lint stage).
+# golangci-lint v2.12.2
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2"
 
 PKGMGR=""
 SUDO=""