Clear all golangci-lint findings and make the CI build green (closes #1)

Fix every golangci-lint finding under the repo's standard .golangci.yml
(from ~192 down to 0 under the pinned v2.10.1) without changing program
behavior:

- gochecknoglobals: replace the verbose/quiet/exclude* package globals with
  an options struct threaded through the command implementations.
- err113: introduce package-level sentinel errors and wrap them with %w.
- errcheck: check or explicitly discard every previously unchecked error
  (bar.Add/Finish, deferred Close, verbose writes).
- forbidigo: route verbose output through os.Stdout instead of fmt.Print*.
- noinlineerr / wsl_v5 / nlreturn / gofmt: split inline error checks and
  normalize whitespace.
- complexity (cyclop/gocognit/nestif): extract small behavior-preserving
  helpers (runOverPaths, countAndBar, walkSkip, clearOne, checkOne,
  missingChecksum, reportCheck).
- mnd/lll/nonamedreturns/revive/modernize/nilnil: named constants, wrapped
  lines, unnamed returns, doc comments, SplitSeq, non-(nil,nil) returns.
- paralleltest/thelper: mark tests parallel (now race-safe with no shared
  globals) and add t.Helper(); probe the real xattr key so the guard is
  accurate.

Also make the tests actually runnable in CI rather than skipping:

- move the xattr keys into the user.* namespace (user.berlin.sneak.app.*),
  which Linux requires for regular-file xattrs; macOS treats the whole
  string as an opaque name, so behavior is unchanged there.
- run the Docker builder's checks as an unprivileged user so the permission
  tests are meaningful (root bypasses file mode bits).

Dockerfile

@@ -15,10 +15,20 @@ RUN go mod download
 
 COPY . .
 
+# Run the checks as an unprivileged user. Root bypasses file mode bits, which
+# would make the permission tests (expecting EACCES on a 0000 file) spuriously
+# pass with no error. Caches live under /tmp (world-writable) so the user needs
+# no home directory of its own.
+ENV GOCACHE=/tmp/gocache
+ENV XDG_CACHE_HOME=/tmp/xdgcache
+RUN adduser -D -u 1000 builder && chown -R builder:builder /src /go
+USER builder
+
 # Run all checks - build fails if any check fails
 RUN make check
 
-# Build the binary
+# Build the binary (still as the unprivileged user: it owns /src, so git VCS
+# stamping sees consistent ownership).
 RUN make build
 
 # Runtime stage