Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/vaultik/purge_per_name_test.go

@@ -16,12 +16,19 @@ import (
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
+// Snapshot IDs reused across the purge tests.
+const (
+	snapSystemT0 = "testhost_system_2026-01-01T00:00:00Z"
+	snapHomeT0   = "testhost_home_2026-01-01T00:00:00Z"
+	snapHomeT1   = "testhost_home_2026-01-01T01:00:00Z"
+	snapHomeT3   = "testhost_home_2026-01-01T03:00:00Z"
+)
+
 // setupPurgeTest creates a Vaultik instance with an in-memory database and mock
 // storage pre-populated with the given snapshot IDs. Each snapshot is marked as
 // completed. Remote metadata stubs are created so syncWithRemote keeps them.
 func setupPurgeTest(t *testing.T, snapshotIDs []string) *vaultik.Vaultik {
 	t.Helper()
-	log.Initialize(log.Config{})
 
 	ctx := context.Background()
 	db, err := database.New(ctx, ":memory:")
@@ -44,7 +51,7 @@ func setupPurgeTest(t *testing.T, snapshotIDs []string) *vaultik.Vaultik {
 		snap := &database.Snapshot{
 			ID:             types.SnapshotID(id),
 			Hostname:       "testhost",
-			VaultikVersion: "test",
+			VaultikVersion: testLabel,
 			StartedAt:      startedAt,
 			CompletedAt:    &completedAt,
 		}
@@ -96,13 +103,16 @@ func listRemainingSnapshots(t *testing.T, v *vaultik.Vaultik) []string {
 }
 
 func TestPurgeKeepLatest_PerName(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	// Create snapshots for two different names: "home" and "system".
 	// With per-name --keep-latest, the latest of each should be kept.
 	snapshotIDs := []string{
-		"testhost_system_2026-01-01T00:00:00Z",
-		"testhost_home_2026-01-01T01:00:00Z",
+		snapSystemT0,
+		snapHomeT1,
 		"testhost_system_2026-01-01T02:00:00Z",
-		"testhost_home_2026-01-01T03:00:00Z",
+		snapHomeT3,
 		"testhost_system_2026-01-01T04:00:00Z",
 	}
 
@@ -118,15 +128,19 @@ func TestPurgeKeepLatest_PerName(t *testing.T) {
 
 	// Should keep the latest of each name
 	assert.Len(t, remaining, 2, "should keep exactly 2 snapshots (one per name)")
-	assert.Contains(t, remaining, "testhost_system_2026-01-01T04:00:00Z", "should keep latest system")
-	assert.Contains(t, remaining, "testhost_home_2026-01-01T03:00:00Z", "should keep latest home")
+	assert.Contains(t, remaining, "testhost_system_2026-01-01T04:00:00Z",
+		"should keep latest system")
+	assert.Contains(t, remaining, snapHomeT3, "should keep latest home")
 }
 
 func TestPurgeKeepLatest_SingleName(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	// All snapshots have the same name — keep-latest should keep exactly one.
 	snapshotIDs := []string{
-		"testhost_home_2026-01-01T00:00:00Z",
-		"testhost_home_2026-01-01T01:00:00Z",
+		snapHomeT0,
+		snapHomeT1,
 		"testhost_home_2026-01-01T02:00:00Z",
 	}
 
@@ -140,17 +154,21 @@ func TestPurgeKeepLatest_SingleName(t *testing.T) {
 
 	remaining := listRemainingSnapshots(t, v)
 	assert.Len(t, remaining, 1)
-	assert.Contains(t, remaining, "testhost_home_2026-01-01T02:00:00Z", "should keep the newest")
+	assert.Contains(t, remaining, "testhost_home_2026-01-01T02:00:00Z",
+		"should keep the newest")
 }
 
 func TestPurgeKeepLatest_WithNameFilter(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	// Use --name to filter purge to only "home" snapshots.
 	// "system" snapshots should be untouched.
 	snapshotIDs := []string{
-		"testhost_system_2026-01-01T00:00:00Z",
-		"testhost_home_2026-01-01T01:00:00Z",
+		snapSystemT0,
+		snapHomeT1,
 		"testhost_system_2026-01-01T02:00:00Z",
-		"testhost_home_2026-01-01T03:00:00Z",
+		snapHomeT3,
 		"testhost_home_2026-01-01T04:00:00Z",
 	}
 
@@ -167,12 +185,15 @@ func TestPurgeKeepLatest_WithNameFilter(t *testing.T) {
 
 	// 2 system snapshots untouched + 1 latest home = 3
 	assert.Len(t, remaining, 3)
-	assert.Contains(t, remaining, "testhost_system_2026-01-01T00:00:00Z")
+	assert.Contains(t, remaining, snapSystemT0)
 	assert.Contains(t, remaining, "testhost_system_2026-01-01T02:00:00Z")
 	assert.Contains(t, remaining, "testhost_home_2026-01-01T04:00:00Z")
 }
 
 func TestPurgeKeepLatest_NoSnapshots(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	v := setupPurgeTest(t, nil)
 
 	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
@@ -183,8 +204,11 @@ func TestPurgeKeepLatest_NoSnapshots(t *testing.T) {
 }
 
 func TestPurgeKeepLatest_NameFilterNoMatch(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	snapshotIDs := []string{
-		"testhost_system_2026-01-01T00:00:00Z",
+		snapSystemT0,
 		"testhost_system_2026-01-01T01:00:00Z",
 	}
 
@@ -203,13 +227,16 @@ func TestPurgeKeepLatest_NameFilterNoMatch(t *testing.T) {
 }
 
 func TestPurgeOlderThan_WithNameFilter(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	// Snapshots with different names and timestamps.
 	// --older-than should apply only to the named subset when --name is used.
 	snapshotIDs := []string{
 		"testhost_system_2020-01-01T00:00:00Z",
 		"testhost_home_2020-01-01T00:00:00Z",
-		"testhost_system_2026-01-01T00:00:00Z",
-		"testhost_home_2026-01-01T00:00:00Z",
+		snapSystemT0,
+		snapHomeT0,
 	}
 
 	v := setupPurgeTest(t, snapshotIDs)
@@ -227,14 +254,17 @@ func TestPurgeOlderThan_WithNameFilter(t *testing.T) {
 	// Old system stays (not filtered by name), old home deleted, recent ones stay
 	assert.Len(t, remaining, 3)
 	assert.Contains(t, remaining, "testhost_system_2020-01-01T00:00:00Z")
-	assert.Contains(t, remaining, "testhost_system_2026-01-01T00:00:00Z")
-	assert.Contains(t, remaining, "testhost_home_2026-01-01T00:00:00Z")
+	assert.Contains(t, remaining, snapSystemT0)
+	assert.Contains(t, remaining, snapHomeT0)
 }
 
 func TestPurgeKeepLatest_ThreeNames(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	// Three different snapshot names with multiple snapshots each.
 	snapshotIDs := []string{
-		"testhost_home_2026-01-01T00:00:00Z",
+		snapHomeT0,
 		"testhost_system_2026-01-01T01:00:00Z",
 		"testhost_media_2026-01-01T02:00:00Z",
 		"testhost_home_2026-01-01T03:00:00Z",