refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

Dockerfile

@@ -1,56 +1,58 @@
-# golang:1.24 (bookworm) — 2026-03-01
-# Using Debian-based image because gorm.io/driver/sqlite pulls in
-# mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
-FROM golang@sha256:d2d2bc1c84f7e60d7d2438a3836ae7d0c847f4888464e7ec9ba3a1339a1ee804 AS builder
+# Lint stage
+# golangci/golangci-lint:v2.11.3 (Debian-based), 2026-03-17
+# Using Debian-based image because mattn/go-sqlite3 (CGO) does not
+# compile on Alpine musl (off64_t is a glibc type).
+FROM golangci/golangci-lint:v2.11.3@sha256:e838e8ab68aaefe83e2408691510867ade9329c0e0b895a3fb35eb93d1c2a4ba AS lint
 
-# gcc is pre-installed in the Debian-based golang image
 RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /build
+WORKDIR /src
 
-# Install golangci-lint v1.64.8 — 2026-03-01
-# Using v1.x because the repo's .golangci.yml uses v1 config format.
-RUN set -eux; \
-    GOLANGCI_VERSION="1.64.8"; \
-    ARCH="$(uname -m)"; \
-    case "${ARCH}" in \
-        x86_64) \
-            GOARCH="amd64"; \
-            GOLANGCI_SHA256="b6270687afb143d019f387c791cd2a6f1cb383be9b3124d241ca11bd3ce2e54e"; \
-            ;; \
-        aarch64) \
-            GOARCH="arm64"; \
-            GOLANGCI_SHA256="a6ab58ebcb1c48572622146cdaec2956f56871038a54ed1149f1386e287789a5"; \
-            ;; \
-        *) echo "unsupported architecture: ${ARCH}" && exit 1 ;; \
-    esac; \
-    wget -q "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_VERSION}/golangci-lint-${GOLANGCI_VERSION}-linux-${GOARCH}.tar.gz" \
-        -O /tmp/golangci-lint.tar.gz; \
-    echo "${GOLANGCI_SHA256}  /tmp/golangci-lint.tar.gz" | sha256sum -c -; \
-    tar -xzf /tmp/golangci-lint.tar.gz -C /tmp; \
-    mv "/tmp/golangci-lint-${GOLANGCI_VERSION}-linux-${GOARCH}/golangci-lint" /usr/local/bin/; \
-    rm -rf /tmp/golangci-lint*; \
-    golangci-lint --version
-
-# Copy go module files and download dependencies
+# Copy go mod files first for better layer caching
 COPY go.mod go.sum ./
 RUN go mod download
 
 # Copy source code
 COPY . .
 
-# Run all checks (fmt-check, lint, test, build)
-RUN make check
+# Run formatting check and linter
+RUN make fmt-check
+RUN make lint
+
+# Build stage
+# golang:1.26.1-bookworm (Debian-based), 2026-03-17
+# Using Debian-based image because gorm.io/driver/sqlite pulls in
+# mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
+FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
+
+# Depend on lint stage passing
+COPY --from=lint /src/go.sum /dev/null
+
+RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Copy go mod files first for better layer caching
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Run tests and build
+RUN make test
+RUN make build
 
 # Rebuild with static linking for Alpine runtime.
-# make check already verified formatting, linting, tests, and compilation.
+# make build already verified compilation.
 # The CGO binary from `make build` is dynamically linked against glibc,
 # which doesn't exist on Alpine (musl). Rebuild with static linking so
 # the binary runs on Alpine without glibc.
 RUN CGO_ENABLED=1 go build -ldflags '-extldflags "-static"' -o bin/webhooker ./cmd/webhooker
 
-# alpine:3.21 — 2026-03-01
-FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+# Runtime stage
+# alpine:3.21, 2026-03-17
+FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
 RUN apk --no-cache add ca-certificates