style: mechanical lint conformance for #55's code under the canonical config

No behavior changes. Covers the purely mechanical findings the canonical
v2.12.2 config raises on the cache-size/eviction work:

- nolintlint: deleted 7 dead //nolint:gosec directives (cachesize.go x2,
  config.go, eviction.go x2, storage.go x2). gosec never raises G115/G703
  on those lines under the pinned toolchain, exactly the defect class
  that failed round 2 of this PR. The 6 live gosec suppressions are
  untouched.
- funcorder: moved writeIfAbsent after Exists (storage.go) and
  touchVariant/touchSourceContent after IncrementStats (cache.go).
- lll: wrapped over-length signatures, calls and messages at 88 columns.
- paralleltest: t.Parallel() on the new eviction, contentlock and
  cache_max_bytes tests and their subtests. configFromYAML uses only
  t.TempDir, so the config cases are parallel-safe.
- noctx: test helper DB calls now use ExecContext/QueryContext/
  QueryRowContext with t.Context().
- goconst: extracted testHeaderContentType into the shared test constant
  block and testVariantKeyOne into the eviction tests; reused the
  existing testContentTypeJPEG and keyCacheMaxBytes constants.
- modernize: interface{} to any, atomic.Int32 for the contentlock
  counters, min/max in ComputeDefaultCacheMaxBytes.
- intrange: integer range loops in the contentlock tests.
- wsl_v5: whitespace before the contentlock rendezvous statements.
- sloglint: slog.DiscardHandler in the config test logger.
- cyclop/funlen: split TestZeroMaxBytesDisablesDiskCache into four
  assertion helpers and extracted the concurrent store goroutine from
  TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent. Every
  assertion is preserved verbatim; only their grouping changed.

internal/imgcache/contentlock_internal_test.go

@@ -10,10 +10,12 @@ import (
 // TestContentLockExcludesSameKey verifies that two goroutines locking
 // the same key never run their critical sections concurrently.
 func TestContentLockExcludesSameKey(t *testing.T) {
+	t.Parallel()
+
 	lock := newContentLock()
 
 	var (
-		active  int32
+		active  atomic.Int32
 		maxSeen int32
 		wg      sync.WaitGroup
 	)
@@ -22,14 +24,14 @@ func TestContentLockExcludesSameKey(t *testing.T) {
 
 	wg.Add(goroutines)
 
-	for i := 0; i < goroutines; i++ {
+	for range goroutines {
 		go func() {
 			defer wg.Done()
 
 			unlock := lock.Lock("same-key")
 			defer unlock()
 
-			n := atomic.AddInt32(&active, 1)
+			n := active.Add(1)
 
 			for {
 				seen := atomic.LoadInt32(&maxSeen)
@@ -40,7 +42,7 @@ func TestContentLockExcludesSameKey(t *testing.T) {
 
 			time.Sleep(time.Millisecond)
 
-			atomic.AddInt32(&active, -1)
+			active.Add(-1)
 		}()
 	}
 
@@ -57,13 +59,15 @@ func TestContentLockExcludesSameKey(t *testing.T) {
 // them reaching the rendezvous point before any is allowed to
 // proceed.
 func TestContentLockAllowsDifferentKeys(t *testing.T) {
+	t.Parallel()
+
 	lock := newContentLock()
 
 	const goroutines = 20
 
 	var (
 		wg      sync.WaitGroup
-		inside  int32
+		inside  atomic.Int32
 		reached = make(chan struct{}, goroutines)
 	)
 
@@ -71,7 +75,7 @@ func TestContentLockAllowsDifferentKeys(t *testing.T) {
 
 	release := make(chan struct{})
 
-	for i := 0; i < goroutines; i++ {
+	for i := range goroutines {
 		key := string(rune('a' + i))
 
 		go func() {
@@ -80,8 +84,10 @@ func TestContentLockAllowsDifferentKeys(t *testing.T) {
 			unlock := lock.Lock(key)
 			defer unlock()
 
-			atomic.AddInt32(&inside, 1)
+			inside.Add(1)
+
 			reached <- struct{}{}
+
 			<-release
 		}()
 	}
@@ -90,7 +96,7 @@ func TestContentLockAllowsDifferentKeys(t *testing.T) {
 	// own key's lock) without needing any other to release first. If
 	// keys were incorrectly serialized onto one underlying lock, only
 	// one would get here and this would time out.
-	for i := 0; i < goroutines; i++ {
+	for i := range goroutines {
 		select {
 		case <-reached:
 		case <-time.After(2 * time.Second):
@@ -99,8 +105,9 @@ func TestContentLockAllowsDifferentKeys(t *testing.T) {
 		}
 	}
 
-	if n := atomic.LoadInt32(&inside); n != goroutines {
-		t.Errorf("goroutines inside their critical section = %d, want %d", n, goroutines)
+	if n := inside.Load(); n != goroutines {
+		t.Errorf("goroutines inside their critical section = %d, want %d",
+			n, goroutines)
 	}
 
 	close(release)
@@ -111,6 +118,8 @@ func TestContentLockAllowsDifferentKeys(t *testing.T) {
 // entries map does not grow without bound: once no goroutine holds or
 // awaits a key, its entry is removed.
 func TestContentLockRemovesEntryAfterUnlock(t *testing.T) {
+	t.Parallel()
+
 	lock := newContentLock()
 
 	unlock := lock.Lock("k")