Clear all golangci-lint findings and make the CI build green (closes #1)

Fix every golangci-lint finding under the repo's standard .golangci.yml
(from ~192 down to 0 under the pinned v2.10.1) without changing program
behavior:

- gochecknoglobals: replace the verbose/quiet/exclude* package globals with
  an options struct threaded through the command implementations.
- err113: introduce package-level sentinel errors and wrap them with %w.
- errcheck: check or explicitly discard every previously unchecked error
  (bar.Add/Finish, deferred Close, verbose writes).
- forbidigo: route verbose output through os.Stdout instead of fmt.Print*.
- noinlineerr / wsl_v5 / nlreturn / gofmt: split inline error checks and
  normalize whitespace.
- complexity (cyclop/gocognit/nestif): extract small behavior-preserving
  helpers (runOverPaths, countAndBar, walkSkip, clearOne, checkOne,
  missingChecksum, reportCheck).
- mnd/lll/nonamedreturns/revive/modernize/nilnil: named constants, wrapped
  lines, unnamed returns, doc comments, SplitSeq, non-(nil,nil) returns.
- paralleltest/thelper: mark tests parallel (now race-safe with no shared
  globals) and add t.Helper(); probe the real xattr key so the guard is
  accurate.

Also make the tests actually runnable in CI rather than skipping:

- move the xattr keys into the user.* namespace (user.berlin.sneak.app.*),
  which Linux requires for regular-file xattrs; macOS treats the whole
  string as an opaque name, so behavior is unchanged there.
- run the Docker builder's checks as an unprivileged user so the permission
  tests are meaningful (root bypasses file mode bits).

README.md

@@ -55,8 +55,8 @@ attrsum -q sum add DIR
 
 | xattr key                                   | meaning                        |
 |---------------------------------------------|--------------------------------|
-| `berlin.sneak.app.attrsum.checksum`         | base-58 multihash (sha2-256)   |
-| `berlin.sneak.app.attrsum.sumtime`          | RFC 3339 timestamp of checksum |
+| `user.berlin.sneak.app.attrsum.checksum`    | base-58 multihash (sha2-256)   |
+| `user.berlin.sneak.app.attrsum.sumtime`     | RFC 3339 timestamp of checksum |
 
 Flags: