Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/docker/validation_test.go

@@ -6,11 +6,14 @@ import (
 	"testing"
 )
 
+// mainBranch is the branch name used across validation tests.
+const mainBranch = "main"
+
 func TestValidBranchRegex(t *testing.T) {
 	t.Parallel()
 
 	valid := []string{
-		"main",
+		mainBranch,
 		"develop",
 		"feature/my-feature",
 		"release-1.0",
@@ -70,7 +73,7 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
+func TestCloneRepoRejectsInjection(t *testing.T) {
 	t.Parallel()
 
 	c := &Client{
@@ -100,25 +103,25 @@ func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driv
 		},
 		{
 			name:      "injection in commitSHA",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "not-a-sha; rm -rf /",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "short SHA rejected",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "abc123",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "valid inputs pass validation (hit NotConnected)",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "abc123def456789012345678901234567890abcd",
 			wantErr:   ErrNotConnected,
 		},
 		{
 			name:    "valid branch no SHA passes validation (hit NotConnected)",
-			branch:  "main",
+			branch:  mainBranch,
 			wantErr: ErrNotConnected,
 		},
 	}