fix: use prebuilt golangci-lint binary in Docker (multi-arch)

go install golangci-lint fails in alpine due to missing gold linker.
Download prebuilt binary with arch detection and SHA-256 verification
for both amd64 and arm64.

Verified: make check passes, docker build succeeds on arm64.

Dockerfile

@@ -2,11 +2,23 @@
 # golang:1.25-alpine
 FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
-RUN apk add --no-cache git make gcc musl-dev
+RUN apk add --no-cache git make gcc musl-dev curl
 
-# Install golangci-lint v2
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
-RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0 # v0.42.0
+# Install golangci-lint v2.10.1 (prebuilt binary, multi-arch)
+RUN set -e; \
+    ARCH="$(uname -m)"; \
+    case "$ARCH" in \
+        x86_64)  ARCH=amd64; SHA256="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99" ;; \
+        aarch64) ARCH=arm64; SHA256="6652b42ae02915eb2f9cb2a2e0cac99514c8eded8388d88ae3e06e1a52c00de8" ;; \
+        *) echo "Unsupported arch: $ARCH" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/golangci/golangci-lint/releases/download/v2.10.1/golangci-lint-2.10.1-linux-${ARCH}.tar.gz" -o /tmp/golangci-lint.tar.gz; \
+    echo "${SHA256}  /tmp/golangci-lint.tar.gz" | sha256sum -c -; \
+    tar -xzf /tmp/golangci-lint.tar.gz -C /usr/local/bin --strip-components=1 "golangci-lint-2.10.1-linux-${ARCH}/golangci-lint"; \
+    rm /tmp/golangci-lint.tar.gz
+
+# Install goimports v0.42.0
+RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 
 WORKDIR /src
 COPY go.mod go.sum ./