style: mechanical lint conformance for #55's code under the canonical config

No behavior changes. Covers the purely mechanical findings the canonical
v2.12.2 config raises on the cache-size/eviction work:

- nolintlint: deleted 7 dead //nolint:gosec directives (cachesize.go x2,
  config.go, eviction.go x2, storage.go x2). gosec never raises G115/G703
  on those lines under the pinned toolchain, exactly the defect class
  that failed round 2 of this PR. The 6 live gosec suppressions are
  untouched.
- funcorder: moved writeIfAbsent after Exists (storage.go) and
  touchVariant/touchSourceContent after IncrementStats (cache.go).
- lll: wrapped over-length signatures, calls and messages at 88 columns.
- paralleltest: t.Parallel() on the new eviction, contentlock and
  cache_max_bytes tests and their subtests. configFromYAML uses only
  t.TempDir, so the config cases are parallel-safe.
- noctx: test helper DB calls now use ExecContext/QueryContext/
  QueryRowContext with t.Context().
- goconst: extracted testHeaderContentType into the shared test constant
  block and testVariantKeyOne into the eviction tests; reused the
  existing testContentTypeJPEG and keyCacheMaxBytes constants.
- modernize: interface{} to any, atomic.Int32 for the contentlock
  counters, min/max in ComputeDefaultCacheMaxBytes.
- intrange: integer range loops in the contentlock tests.
- wsl_v5: whitespace before the contentlock rendezvous statements.
- sloglint: slog.DiscardHandler in the config test logger.
- cyclop/funlen: split TestZeroMaxBytesDisablesDiskCache into four
  assertion helpers and extracted the concurrent store goroutine from
  TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent. Every
  assertion is preserved verbatim; only their grouping changed.

internal/imgcache/storage.go

@@ -79,7 +79,9 @@ func (s *ContentStorage) Store(r io.Reader) (ContentHash, int64, error) {
 // across the whole store operation) use this instead of Store. Like
 // Store, it is idempotent: content already on disk at that path is
 // left untouched.
-func (s *ContentStorage) StoreHashed(hash ContentHash, data []byte) (size int64, err error) {
+func (s *ContentStorage) StoreHashed(
+	hash ContentHash, data []byte,
+) (size int64, err error) {
 	if err := s.writeIfAbsent(hash, data); err != nil {
 		return 0, err
 	}
@@ -87,57 +89,6 @@ func (s *ContentStorage) StoreHashed(hash ContentHash, data []byte) (size int64,
 	return int64(len(data)), nil
 }
 
-// writeIfAbsent writes data to the path derived from hash, unless
-// content already exists there, via a temp-file-plus-rename so
-// concurrent readers never observe a partial file.
-func (s *ContentStorage) writeIfAbsent(hash ContentHash, data []byte) (err error) {
-	// Build path: <basedir>/<ab>/<cd>/<hash>
-	path := s.hashToPath(hash)
-
-	// Check if already exists
-	if _, statErr := os.Stat(path); statErr == nil {
-		return nil
-	}
-
-	// Create directory structure
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, StorageDirPerm); err != nil {
-		return fmt.Errorf("failed to create directory: %w", err)
-	}
-
-	// Write to temp file first, then rename for atomicity
-	tmpFile, err := os.CreateTemp(dir, ".tmp-*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp file: %w", err)
-	}
-
-	tmpPath := tmpFile.Name()
-
-	defer func() {
-		if err != nil {
-			_ = os.Remove(tmpPath)
-		}
-	}()
-
-	if _, err := tmpFile.Write(data); err != nil {
-		_ = tmpFile.Close()
-
-		return fmt.Errorf("failed to write content: %w", err)
-	}
-
-	if err := tmpFile.Close(); err != nil {
-		return fmt.Errorf("failed to close temp file: %w", err)
-	}
-
-	// Atomic rename
-	//nolint:gosec // G703: paths from internal SHA256 hashes
-	if err := os.Rename(filepath.Clean(tmpPath), filepath.Clean(path)); err != nil {
-		return fmt.Errorf("failed to rename temp file: %w", err)
-	}
-
-	return nil
-}
-
 // Load returns a reader for the content with the given hash.
 func (s *ContentStorage) Load(hash ContentHash) (io.ReadCloser, error) {
 	path := s.hashToPath(hash)
@@ -197,6 +148,56 @@ func (s *ContentStorage) Exists(hash ContentHash) bool {
 	return err == nil
 }
 
+// writeIfAbsent writes data to the path derived from hash, unless
+// content already exists there, via a temp-file-plus-rename so
+// concurrent readers never observe a partial file.
+func (s *ContentStorage) writeIfAbsent(hash ContentHash, data []byte) (err error) {
+	// Build path: <basedir>/<ab>/<cd>/<hash>
+	path := s.hashToPath(hash)
+
+	// Check if already exists
+	if _, statErr := os.Stat(path); statErr == nil {
+		return nil
+	}
+
+	// Create directory structure
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, StorageDirPerm); err != nil {
+		return fmt.Errorf("failed to create directory: %w", err)
+	}
+
+	// Write to temp file first, then rename for atomicity
+	tmpFile, err := os.CreateTemp(dir, ".tmp-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp file: %w", err)
+	}
+
+	tmpPath := tmpFile.Name()
+
+	defer func() {
+		if err != nil {
+			_ = os.Remove(tmpPath)
+		}
+	}()
+
+	if _, err := tmpFile.Write(data); err != nil {
+		_ = tmpFile.Close()
+
+		return fmt.Errorf("failed to write content: %w", err)
+	}
+
+	if err := tmpFile.Close(); err != nil {
+		return fmt.Errorf("failed to close temp file: %w", err)
+	}
+
+	// Atomic rename
+	if err := os.Rename(filepath.Clean(tmpPath), filepath.Clean(path)); err != nil {
+		return fmt.Errorf("failed to rename temp file: %w", err)
+	}
+
+	return nil
+}
+
 // hashToPath converts a hash to a file path: <basedir>/<ab>/<cd>/<hash>
 func (s *ContentStorage) hashToPath(hash ContentHash) string {
 	h := string(hash)
@@ -552,7 +553,6 @@ func (s *VariantStorage) DeleteWithMeta(key VariantKey) error {
 
 	metaPath := s.keyToPath(key) + ".meta"
 
-	//nolint:gosec // G703: path derived from cache key
 	err := os.Remove(metaPath)
 	if err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("failed to delete variant metadata: %w", err)