style: mechanical lint conformance for #55's code under the canonical config

No behavior changes. Covers the purely mechanical findings the canonical
v2.12.2 config raises on the cache-size/eviction work:

- nolintlint: deleted 7 dead //nolint:gosec directives (cachesize.go x2,
  config.go, eviction.go x2, storage.go x2). gosec never raises G115/G703
  on those lines under the pinned toolchain, exactly the defect class
  that failed round 2 of this PR. The 6 live gosec suppressions are
  untouched.
- funcorder: moved writeIfAbsent after Exists (storage.go) and
  touchVariant/touchSourceContent after IncrementStats (cache.go).
- lll: wrapped over-length signatures, calls and messages at 88 columns.
- paralleltest: t.Parallel() on the new eviction, contentlock and
  cache_max_bytes tests and their subtests. configFromYAML uses only
  t.TempDir, so the config cases are parallel-safe.
- noctx: test helper DB calls now use ExecContext/QueryContext/
  QueryRowContext with t.Context().
- goconst: extracted testHeaderContentType into the shared test constant
  block and testVariantKeyOne into the eviction tests; reused the
  existing testContentTypeJPEG and keyCacheMaxBytes constants.
- modernize: interface{} to any, atomic.Int32 for the contentlock
  counters, min/max in ComputeDefaultCacheMaxBytes.
- intrange: integer range loops in the contentlock tests.
- wsl_v5: whitespace before the contentlock rendezvous statements.
- sloglint: slog.DiscardHandler in the config test logger.
- cyclop/funlen: split TestZeroMaxBytesDisablesDiskCache into four
  assertion helpers and extracted the concurrent store goroutine from
  TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent. Every
  assertion is preserved verbatim; only their grouping changed.

internal/config/cachesize.go

@@ -44,7 +44,7 @@ func defaultFreeSpaceProbe(path string) (uint64, error) {
 		return 0, fmt.Errorf("statfs reported negative block size %d for %q", stat.Bsize, path)
 	}
 
-	blockSize := uint64(stat.Bsize) //nolint:gosec // G115: negative Bsize rejected above
+	blockSize := uint64(stat.Bsize)
 
 	return stat.Bavail * blockSize, nil
 }
@@ -52,7 +52,9 @@ func defaultFreeSpaceProbe(path string) (uint64, error) {
 // ComputeDefaultCacheMaxBytes returns the default cache size limit for
 // the filesystem containing cacheDir: 75% of the free bytes reported
 // by probe, with a floor of DefaultCacheMaxBytesFloor.
-func ComputeDefaultCacheMaxBytes(cacheDir string, probe FreeSpaceProbeFunc) (int64, error) {
+func ComputeDefaultCacheMaxBytes(
+	cacheDir string, probe FreeSpaceProbeFunc,
+) (int64, error) {
 	freeBytes, err := probe(cacheDir)
 	if err != nil {
 		return 0, fmt.Errorf("config key %q: cannot determine free space for %q: %w",
@@ -60,15 +62,10 @@ func ComputeDefaultCacheMaxBytes(cacheDir string, probe FreeSpaceProbeFunc) (int
 	}
 
 	computed := freeBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
-	if computed > math.MaxInt64 {
-		computed = math.MaxInt64
-	}
+	computed = min(computed, math.MaxInt64)
 
-	limit := int64(computed) //nolint:gosec // G115: clamped to MaxInt64 above
-
-	if limit < DefaultCacheMaxBytesFloor {
-		limit = DefaultCacheMaxBytesFloor
-	}
+	limit := int64(computed)
+	limit = max(limit, DefaultCacheMaxBytesFloor)
 
 	return limit, nil
 }
@@ -79,7 +76,9 @@ func ComputeDefaultCacheMaxBytes(cacheDir string, probe FreeSpaceProbeFunc) (int
 // on free space in <state_dir>/cache/. The cache directory is created
 // first so statfs measures the filesystem that will actually hold the
 // cache. The effective limit is logged either way.
-func (c *Config) resolveCacheMaxBytes(log *slog.Logger, probe FreeSpaceProbeFunc) error {
+func (c *Config) resolveCacheMaxBytes(
+	log *slog.Logger, probe FreeSpaceProbeFunc,
+) error {
 	if !c.cacheMaxBytesExplicit {
 		cacheDir := filepath.Join(c.StateDir, "cache")