refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/config/config_test.go

@@ -57,16 +57,14 @@ func TestEnvironmentConfig(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			// Set environment variable if specified
 			if tt.envValue != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", tt.envValue)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				t.Setenv("WEBHOOKER_ENVIRONMENT", tt.envValue)
 			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				require.NoError(t, os.Unsetenv("WEBHOOKER_ENVIRONMENT"))
 			}
 
 			// Set additional environment variables
 			for k, v := range tt.envVars {
-				os.Setenv(k, v)
-				defer os.Unsetenv(k)
+				t.Setenv(k, v)
 			}
 
 			if tt.expectError {
@@ -115,12 +113,11 @@ func TestDefaultDataDir(t *testing.T) {
 		}
 		t.Run("env="+name, func(t *testing.T) {
 			if env != "" {
-				os.Setenv("WEBHOOKER_ENVIRONMENT", env)
-				defer os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				t.Setenv("WEBHOOKER_ENVIRONMENT", env)
 			} else {
-				os.Unsetenv("WEBHOOKER_ENVIRONMENT")
+				require.NoError(t, os.Unsetenv("WEBHOOKER_ENVIRONMENT"))
 			}
-			os.Unsetenv("DATA_DIR")
+			require.NoError(t, os.Unsetenv("DATA_DIR"))
 
 			var cfg *Config
 			app := fxtest.New(