Adopt the shared .golangci.yml and fix the code to it (closes #6)

Vendor .golangci.yml byte-identical from sneak/prompts at cc440118 and
move the Dockerfile lint phase to golangci-lint v2.14.0 by the digest
REPO_POLICIES.md names. Fix the code to that config with flags, help
text, output files, SQL and the order of steps unchanged; long
functions are split into named steps.

Judgement call: the extraction transaction is now rolled back on every
early return; the old deferred rollback missed most failures and could
dereference a nil transaction.
Wording change: the reversed-range error reads "--from is after --to
(--from X, --to Y)", since err113 requires a wrapped sentinel.
Ten //nolint directives (gosec, mnd, unqueryvet), each with its reason.

Model: opus-5-5

TODO.md

@@ -14,12 +14,14 @@ pre-1.0
 
 # Next Step
 
-Add the canonical `.golangci.yml`, move the lint phase to golangci-lint
-v2.14.0 in the same commit, and fix the findings it surfaces
-(https://git.eeqj.de/sneak/bsdaily/issues/6).
+Format Markdown with prettier in `script/fmt` and `script/fmt-check`
+(https://git.eeqj.de/sneak/bsdaily/issues/7).
 
 # Completed Steps
 
+- 2026-10-06: Added the canonical `.golangci.yml`, moved the lint phase to
+  golangci-lint v2.14.0, and fixed the code to pass it
+  (https://git.eeqj.de/sneak/bsdaily/issues/6).
 - 2026-10-05: Brought the repo up to the standard layout: canonical
   `.gitignore`, `.dockerignore` and `.editorconfig`; `lint` and `test`
   phases in the `Dockerfile`, built by `script/lint` and `script/test`;
@@ -41,8 +43,6 @@ v2.14.0 in the same commit, and fix the findings it surfaces
 
 # Future Steps
 
-- Format Markdown with prettier in `script/fmt` and `script/fmt-check`
-  (https://git.eeqj.de/sneak/bsdaily/issues/7).
 - Expand tests beyond the compilation smoke test: unit tests for the
   extraction, verification, and atomic-publish paths.
 - Cut a first SemVer release once compliance and test coverage land.