Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/blobgen/compress.go

@@ -1,3 +1,6 @@
+// Package blobgen implements the blob data pipeline: streaming zstd
+// compression, age encryption, and SHA256 content hashing for blob
+// creation, plus the matching decrypt/decompress/verify reader.
 package blobgen
 
 import (
@@ -16,7 +19,9 @@ type CompressResult struct {
 }
 
 // CompressData compresses and encrypts data, returning the result with hash
-func CompressData(data []byte, compressionLevel int, recipients []string) (*CompressResult, error) {
+func CompressData(
+	data []byte, compressionLevel int, recipients []string,
+) (*CompressResult, error) {
 	var buf bytes.Buffer
 
 	// Create writer
@@ -26,14 +31,16 @@ func CompressData(data []byte, compressionLevel int, recipients []string) (*Comp
 	}
 
 	// Write data
-	if _, err := w.Write(data); err != nil {
+	_, err = w.Write(data)
+	if err != nil {
 		_ = w.Close()
 
 		return nil, fmt.Errorf("writing data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return nil, fmt.Errorf("closing writer: %w", err)
 	}
 
@@ -45,8 +52,11 @@ func CompressData(data []byte, compressionLevel int, recipients []string) (*Comp
 	}, nil
 }
 
-// CompressStream compresses and encrypts from reader to writer, returning hash
-func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipients []string) (written int64, hash string, err error) {
+// CompressStream compresses and encrypts from reader to writer, returning
+// the number of uncompressed bytes written and the content hash.
+func CompressStream(
+	dst io.Writer, src io.Reader, compressionLevel int, recipients []string,
+) (int64, string, error) {
 	// Create writer
 	w, err := NewWriter(dst, compressionLevel, recipients)
 	if err != nil {
@@ -61,12 +71,14 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien
 	}()
 
 	// Copy data
-	if _, err := io.Copy(w, src); err != nil {
+	_, err = io.Copy(w, src)
+	if err != nil {
 		return 0, "", fmt.Errorf("copying data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return 0, "", fmt.Errorf("closing writer: %w", err)
 	}