ci: local↔CI test parity — make verify + pinned golangci-lint + .golangci.yml

[bdchatham]

Closes the gap that let staticcheck violations slip to CI on #46/#48: our local loop ran build+test+vet (no golangci-lint), and CI's linter was unpinned (latest).

What (parity + determinism, not a CI rewrite)

• make verify = lint + test + check-bindings — runs exactly what CI gates, in one command. Run it before pushing.
• Pinned golangci-lint v2.12.2 across all three surfaces: the build-and-test.yml action (latest→v2.12.2), a Makefile GOLANGCI_VERSION + make install-lint, and a new .golangci.yml that freezes the enabled linter set (v2.12.2 defaults: errcheck, govet, ineffassign, staticcheck, unused). make lint warns if your PATH binary drifts.
• README "Before you push" section documenting the flow.

Why

go vet doesn't run staticcheck; CI's golangci-lint does — and version: latest drifts (local 2.12.1 vs CI 2.12.2). Pinning + a single verify target makes local results match CI deterministically.

Review

Idiom: clean (mirrors the existing SOLC_VERSION/GETH_VERSION pinning convention). Security: net supply-chain improvement (pinning narrows drift; go install @v2.12.2 is checksum-DB-backed) — no token/permission/trigger changes.

Tracked: PLT-474. (Deferred, noted in review: SHA-pinning the @v7 action major — pre-existing repo convention, repo-wide pass.)

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Changes are limited to CI, Makefile, linter config, and docs; no runtime or application logic is modified.

Overview
Aligns local development with CI so lint failures (especially staticcheck) are caught before push, not only on unpinned CI.

make verify runs lint → test → check-bindings in the same order as the gating workflows (build-and-test + bindings-check). Help and README now tell contributors to run it before pushing.

golangci-lint v2.12.2 is pinned in three places: the build-and-test workflow (latest → v2.12.2), Makefile GOLANGCI_VERSION, and new .golangci.yml (schema v2, explicit enable list matching v2.12.2 defaults: errcheck, govet, ineffassign, staticcheck, unused). make install-lint installs that version; make lint warns if PATH differs; install-tools pulls in the linter alongside existing pinned tools.

README adds a Before you push section; test help text notes -race (unchanged behavior, clearer docs).

^{Reviewed by Cursor Bugbot for commit 2015776. Bugbot is set up for automated code reviews on this repo. Configure here.}