refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/config/config.go

@@ -1,3 +1,4 @@
+// Package config loads application configuration from environment variables.
 package config
 
 import (
@@ -23,13 +24,14 @@ const (
 	EnvironmentProd = "prod"
 )
 
-// nolint:revive // ConfigParams is a standard fx naming convention
+//nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
 	Globals *globals.Globals
 	Logger  *logger.Logger
 }
 
+// Config holds all application configuration loaded from environment variables.
 type Config struct {
 	DataDir         string
 	Debug           bool
@@ -79,7 +81,9 @@ func envInt(key string, defaultValue int) int {
 	return defaultValue
 }
 
-// nolint:revive // lc parameter is required by fx even if unused
+// New creates a Config by reading environment variables.
+//
+//nolint:revive // lc parameter is required by fx even if unused.
 func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 	log := params.Logger.Get()
 

internal/config/config_test.go

@@ -57,16 +57,14 @@ func TestEnvironmentConfig(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			// Set environment variable if specified
 			if tt.envValue != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", tt.envValue)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				t.Setenv("WEBHOOKER_ENVIRONMENT", tt.envValue)
 			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				require.NoError(t, os.Unsetenv("WEBHOOKER_ENVIRONMENT"))
 			}
 
 			// Set additional environment variables
 			for k, v := range tt.envVars {
-				os.Setenv(k, v)
-				defer os.Unsetenv(k)
+				t.Setenv(k, v)
 			}
 
 			if tt.expectError {
@@ -115,12 +113,11 @@ func TestDefaultDataDir(t *testing.T) {
 		}
 		t.Run("env="+name, func(t *testing.T) {
 			if env != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", env)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				t.Setenv("WEBHOOKER_ENVIRONMENT", env)
 			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				require.NoError(t, os.Unsetenv("WEBHOOKER_ENVIRONMENT"))
 			}
-			os.Unsetenv("DATA_DIR")
+			require.NoError(t, os.Unsetenv("DATA_DIR"))
 
 			var cfg *Config
 			app := fxtest.New(