style: mechanical lint conformance for #55's code under the canonical config

No behavior changes. Covers the purely mechanical findings the canonical
v2.12.2 config raises on the cache-size/eviction work:

- nolintlint: deleted 7 dead //nolint:gosec directives (cachesize.go x2,
  config.go, eviction.go x2, storage.go x2). gosec never raises G115/G703
  on those lines under the pinned toolchain, exactly the defect class
  that failed round 2 of this PR. The 6 live gosec suppressions are
  untouched.
- funcorder: moved writeIfAbsent after Exists (storage.go) and
  touchVariant/touchSourceContent after IncrementStats (cache.go).
- lll: wrapped over-length signatures, calls and messages at 88 columns.
- paralleltest: t.Parallel() on the new eviction, contentlock and
  cache_max_bytes tests and their subtests. configFromYAML uses only
  t.TempDir, so the config cases are parallel-safe.
- noctx: test helper DB calls now use ExecContext/QueryContext/
  QueryRowContext with t.Context().
- goconst: extracted testHeaderContentType into the shared test constant
  block and testVariantKeyOne into the eviction tests; reused the
  existing testContentTypeJPEG and keyCacheMaxBytes constants.
- modernize: interface{} to any, atomic.Int32 for the contentlock
  counters, min/max in ComputeDefaultCacheMaxBytes.
- intrange: integer range loops in the contentlock tests.
- wsl_v5: whitespace before the contentlock rendezvous statements.
- sloglint: slog.DiscardHandler in the config test logger.
- cyclop/funlen: split TestZeroMaxBytesDisablesDiskCache into four
  assertion helpers and extracted the concurrent store goroutine from
  TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent. Every
  assertion is preserved verbatim; only their grouping changed.

internal/imgcache/eviction.go

@@ -516,25 +516,28 @@ func (c *Cache) reconcileAccounting(ctx context.Context) error {
 // reconcileVariantFiles walks the variant storage directory, adopting
 // files without accounting rows and sweeping stale temp files.
 func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
-	return filepath.WalkDir(c.variants.baseDir, func(path string, entry fs.DirEntry, err error) error {
-		if err != nil || entry.IsDir() {
-			return err
-		}
+	return filepath.WalkDir(
+		c.variants.baseDir,
+		func(path string, entry fs.DirEntry, err error) error {
+			if err != nil || entry.IsDir() {
+				return err
+			}
 
-		name := entry.Name()
+			name := entry.Name()
 
-		if strings.HasPrefix(name, tempFilePrefix) {
-			c.sweepStaleTempFile(path, entry)
+			if strings.HasPrefix(name, tempFilePrefix) {
+				c.sweepStaleTempFile(path, entry)
 
-			return nil
-		}
+				return nil
+			}
 
-		if strings.HasSuffix(name, variantMetaSuffix) {
-			return nil
-		}
+			if strings.HasSuffix(name, variantMetaSuffix) {
+				return nil
+			}
 
-		return c.adoptVariantFile(ctx, path, entry, VariantKey(name))
-	})
+			return c.adoptVariantFile(ctx, path, entry, VariantKey(name))
+		},
+	)
 }
 
 // adoptVariantFile inserts an accounting row for a variant file that
@@ -581,7 +584,8 @@ func (c *Cache) adoptVariantFile(
 // variantContentTypeFromSidecar reads the content type from a variant
 // .meta sidecar, falling back to application/octet-stream.
 func (c *Cache) variantContentTypeFromSidecar(variantPath string) string {
-	metaData, err := os.ReadFile(variantPath + variantMetaSuffix) //nolint:gosec // path from cache walk
+	//nolint:gosec // path from cache walk
+	metaData, err := os.ReadFile(variantPath + variantMetaSuffix)
 	if err != nil {
 		return fallbackContentType
 	}
@@ -650,21 +654,24 @@ func (c *Cache) allVariantKeys(ctx context.Context) ([]VariantKey, error) {
 // lookups always go through source_metadata) and sweeping stale temp
 // files.
 func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
-	return filepath.WalkDir(c.srcContent.baseDir, func(path string, entry fs.DirEntry, err error) error {
-		if err != nil || entry.IsDir() {
-			return err
-		}
+	return filepath.WalkDir(
+		c.srcContent.baseDir,
+		func(path string, entry fs.DirEntry, err error) error {
+			if err != nil || entry.IsDir() {
+				return err
+			}
 
-		name := entry.Name()
+			name := entry.Name()
 
-		if strings.HasPrefix(name, tempFilePrefix) {
-			c.sweepStaleTempFile(path, entry)
+			if strings.HasPrefix(name, tempFilePrefix) {
+				c.sweepStaleTempFile(path, entry)
 
-			return nil
-		}
+				return nil
+			}
 
-		return c.removeUntrackedSourceFile(ctx, path, ContentHash(name))
-	})
+			return c.removeUntrackedSourceFile(ctx, path, ContentHash(name))
+		},
+	)
 }
 
 // removeUntrackedSourceFile deletes a source blob file that has no
@@ -691,7 +698,6 @@ func (c *Cache) removeUntrackedSourceFile(
 		return fmt.Errorf("failed to delete metadata rows for untracked blob: %w", err)
 	}
 
-	//nolint:gosec // G703: path comes from walking our own cache directory
 	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("failed to remove untracked source file: %w", err)
 	}
@@ -765,7 +771,6 @@ func (c *Cache) sweepStaleTempFile(path string, entry fs.DirEntry) {
 		return
 	}
 
-	//nolint:gosec // G703: path comes from walking our own cache directory
 	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
 		c.log.Warn("failed to remove stale temp file", "path", path, "error", err)