golangci-lint is pinned in one place, the Makefile, and CI reads it; v2.13.2 #789

The linter version was written twice: GOLANGCI_LINT_VERSION in the Makefile, and the install URL in
.github/workflows/ci.yaml. Two copies of one fact drift, and a bump was two edits.

Now the Makefile is the one place, make print-golangci-lint-version prints it, and CI installs that. The pin
moves to v2.13.2: the developer machine runs it, make lint had refused to run here on the mismatch for a
day, and the whole tree is clean on it. With the gate runnable, every commit script runs make check before
it commits -- lint and complexity findings cost seconds at the desk, not ten minutes of CI (#788).

Resolved in #776's worktree, as its own commit.