refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/config/config_test.go

@@ -1,4 +1,4 @@
-package config
+package config_test
 
 import (
 	"os"
@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/logger"
 )
@@ -22,121 +23,143 @@ func TestEnvironmentConfig(t *testing.T) {
 		isProd      bool
 	}{
 		{
-			name:        "default is dev",
-			envValue:    "",
-			envVars:     map[string]string{},
-			expectError: false,
-			isDev:       true,
-			isProd:      false,
+			name:   "default is dev",
+			isDev:  true,
+			isProd: false,
 		},
 		{
-			name:        "explicit dev",
-			envValue:    "dev",
-			envVars:     map[string]string{},
-			expectError: false,
-			isDev:       true,
-			isProd:      false,
+			name:     "explicit dev",
+			envValue: "dev",
+			isDev:    true,
+			isProd:   false,
 		},
 		{
-			name:        "explicit prod",
-			envValue:    "prod",
-			envVars:     map[string]string{},
-			expectError: false,
-			isDev:       false,
-			isProd:      true,
+			name:     "explicit prod",
+			envValue: "prod",
+			isDev:    false,
+			isProd:   true,
 		},
 		{
 			name:        "invalid environment",
 			envValue:    "staging",
-			envVars:     map[string]string{},
 			expectError: true,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Set environment variable if specified
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
 			if tt.envValue != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", tt.envValue)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				t.Setenv(
+					"WEBHOOKER_ENVIRONMENT", tt.envValue,
+				)
 			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				require.NoError(t, os.Unsetenv(
+					"WEBHOOKER_ENVIRONMENT",
+				))
 			}
 
-			// Set additional environment variables
 			for k, v := range tt.envVars {
-				os.Setenv(k, v)
-				defer os.Unsetenv(k)
+				t.Setenv(k, v)
 			}
 
 			if tt.expectError {
-				// Use regular fx.New for error cases since fxtest doesn't expose errors the same way
-				var cfg *Config
-				app := fx.New(
-					fx.NopLogger, // Suppress fx logs in tests
-					fx.Provide(
-						globals.New,
-						logger.New,
-						New,
-					),
-					fx.Populate(&cfg),
-				)
-				assert.Error(t, app.Err())
+				testEnvironmentConfigError(t)
 			} else {
-				// Use fxtest for success cases
-				var cfg *Config
-				app := fxtest.New(
-					t,
-					fx.Provide(
-						globals.New,
-						logger.New,
-						New,
-					),
-					fx.Populate(&cfg),
+				testEnvironmentConfigSuccess(
+					t, tt.isDev, tt.isProd,
 				)
-				require.NoError(t, app.Err())
-				app.RequireStart()
-				defer app.RequireStop()
-
-				assert.Equal(t, tt.isDev, cfg.IsDev())
-				assert.Equal(t, tt.isProd, cfg.IsProd())
 			}
 		})
 	}
 }
 
+func testEnvironmentConfigError(t *testing.T) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fx.New(
+		fx.NopLogger,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+
+	assert.Error(t, app.Err())
+}
+
+func testEnvironmentConfigSuccess(
+	t *testing.T,
+	isDev, isProd bool,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, isDev, cfg.IsDev())
+	assert.Equal(t, isProd, cfg.IsProd())
+}
+
 func TestDefaultDataDir(t *testing.T) {
-	// Verify that when DATA_DIR is unset, the default is /var/lib/webhooker
-	// regardless of the environment setting.
 	for _, env := range []string{"", "dev", "prod"} {
 		name := env
 		if name == "" {
 			name = "unset"
 		}
-		t.Run("env="+name, func(t *testing.T) {
-			if env != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", env)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
-			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
-			}
-			os.Unsetenv("DATA_DIR")
 
-			var cfg *Config
+		t.Run("env="+name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			if env != "" {
+				t.Setenv("WEBHOOKER_ENVIRONMENT", env)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"WEBHOOKER_ENVIRONMENT",
+				))
+			}
+
+			require.NoError(t, os.Unsetenv("DATA_DIR"))
+
+			var cfg *config.Config
+
 			app := fxtest.New(
 				t,
 				fx.Provide(
 					globals.New,
 					logger.New,
-					New,
+					config.New,
 				),
 				fx.Populate(&cfg),
 			)
 			require.NoError(t, app.Err())
+
 			app.RequireStart()
+
 			defer app.RequireStop()
 
-			assert.Equal(t, "/var/lib/webhooker", cfg.DataDir)
+			assert.Equal(
+				t, "/var/lib/webhooker", cfg.DataDir,
+			)
 		})
 	}
 }