Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/crypto/encryption.go

@@ -1,3 +1,5 @@
+// Package crypto provides thread-safe age encryption and decryption
+// helpers used to protect blob and metadata content.
 package crypto
 
 import (
@@ -11,6 +13,10 @@ import (
 	"go.uber.org/fx"
 )
 
+// ErrNoRecipients is returned when an encryptor is created or updated
+// without any recipient public keys.
+var ErrNoRecipients = errors.New("at least one recipient is required")
+
 // Encryptor provides thread-safe encryption using the age encryption library.
 // It supports encrypting data for multiple recipients simultaneously, allowing
 // any of the corresponding private keys to decrypt the data. This is useful
@@ -26,7 +32,7 @@ type Encryptor struct {
 // public keys are invalid or if no recipients are specified.
 func NewEncryptor(publicKeys []string) (*Encryptor, error) {
 	if len(publicKeys) == 0 {
-		return nil, errors.New("at least one recipient is required")
+		return nil, ErrNoRecipients
 	}
 
 	recipients := make([]age.Recipient, 0, len(publicKeys))
@@ -62,12 +68,14 @@ func (e *Encryptor) Encrypt(data []byte) ([]byte, error) {
 	}
 
 	// Write data
-	if _, err := w.Write(data); err != nil {
+	_, err = w.Write(data)
+	if err != nil {
 		return nil, fmt.Errorf("writing encrypted data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return nil, fmt.Errorf("closing encrypted writer: %w", err)
 	}
 
@@ -90,12 +98,14 @@ func (e *Encryptor) EncryptStream(dst io.Writer, src io.Reader) error {
 	}
 
 	// Copy data
-	if _, err := io.Copy(w, src); err != nil {
+	_, err = io.Copy(w, src)
+	if err != nil {
 		return fmt.Errorf("copying encrypted data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return fmt.Errorf("closing encrypted writer: %w", err)
 	}
 
@@ -128,7 +138,7 @@ func (e *Encryptor) EncryptWriter(dst io.Writer) (io.WriteCloser, error) {
 // of the public keys are invalid or if no recipients are specified.
 func (e *Encryptor) UpdateRecipients(publicKeys []string) error {
 	if len(publicKeys) == 0 {
-		return errors.New("at least one recipient is required")
+		return ErrNoRecipients
 	}
 
 	recipients := make([]age.Recipient, 0, len(publicKeys))
@@ -209,4 +219,6 @@ func (d *Decryptor) DecryptStream(src io.Reader) (io.Reader, error) {
 }
 
 // Module exports the crypto module for fx dependency injection.
+//
+//nolint:gochecknoglobals // fx module definitions are package globals
 var Module = fx.Module("crypto")