fix(ci): pin the golangci-lint installer to its release tag

The lint job installed golangci-lint via the install.sh from the master branch,
whose embedded checksums drifted from the v2.12.2 release tarball, so the download
failed checksum verification ("did not verify"). Fetch install.sh from the
matching v$(GOLANGCILINTVERSION) tag instead, so its checksums always match the
release being installed. golangci-lint run itself is clean (0 issues).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gwleclerc

Makefile

@@ -37,7 +37,7 @@ $(REFLEX):
 GOLANGCILINTVERSION:=2.12.2
 GOLANGCILINT=$(GOPATH)/bin/golangci-lint
 $(GOLANGCILINT):
-	curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin v$(GOLANGCILINTVERSION)
+	curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/v$(GOLANGCILINTVERSION)/install.sh | sh -s -- -b $(GOPATH)/bin v$(GOLANGCILINTVERSION)
 
 VENOMVERSION:=v1.0.0-rc.6
 VENOM=$(GOPATH)/bin/venom