Fix every golangci-lint finding under the repo's standard .golangci.yml
(from ~192 down to 0 under the pinned v2.10.1) without changing program
behavior:
- gochecknoglobals: replace the verbose/quiet/exclude* package globals with
an options struct threaded through the command implementations.
- err113: introduce package-level sentinel errors and wrap them with %w.
- errcheck: check or explicitly discard every previously unchecked error
(bar.Add/Finish, deferred Close, verbose writes).
- forbidigo: route verbose output through os.Stdout instead of fmt.Print*.
- noinlineerr / wsl_v5 / nlreturn / gofmt: split inline error checks and
normalize whitespace.
- complexity (cyclop/gocognit/nestif): extract small behavior-preserving
helpers (runOverPaths, countAndBar, walkSkip, clearOne, checkOne,
missingChecksum, reportCheck).
- mnd/lll/nonamedreturns/revive/modernize/nilnil: named constants, wrapped
lines, unnamed returns, doc comments, SplitSeq, non-(nil,nil) returns.
- paralleltest/thelper: mark tests parallel (now race-safe with no shared
globals) and add t.Helper(); probe the real xattr key so the guard is
accurate.
Also make the tests actually runnable in CI rather than skipping:
- move the xattr keys into the user.* namespace (user.berlin.sneak.app.*),
which Linux requires for regular-file xattrs; macOS treats the whole
string as an opaque name, so behavior is unchanged there.
- run the Docker builder's checks as an unprivileged user so the permission
tests are meaningful (root bypasses file mode bits).
