Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/globals/globals.go

@@ -1,3 +1,5 @@
+// Package globals holds application-wide metadata (name, version,
+// commit) that is populated at build time via linker flags.
 package globals
 
 import (
@@ -5,16 +7,16 @@ import (
 )
 
 // Appname is the application name, populated from main().
-var Appname string = "vaultik"
+var Appname = "vaultik" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // Version is the application version, populated from main().
-var Version string = "dev"
+var Version = "dev" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // Commit is the git commit hash, populated from main().
-var Commit string = "unknown"
+var Commit = "unknown" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // CommitDate is the ISO-8601 date of the commit, populated from main().
-var CommitDate string = "unknown"
+var CommitDate = "unknown" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // Author identifies the upstream author of vaultik.
 const Author = "Jeffrey Paul <sneak@sneak.berlin>"
@@ -34,7 +36,8 @@ type Globals struct {
 	StartTime  time.Time
 }
 
-// New creates and returns a new Globals instance initialized with the package-level variables.
+// New creates and returns a new Globals instance initialized with the
+// package-level variables.
 func New() (*Globals, error) {
 	return &Globals{
 		Appname:    Appname,
@@ -44,11 +47,14 @@ func New() (*Globals, error) {
 	}, nil
 }
 
+// shortCommitLen is the number of commit-hash characters ShortCommit keeps.
+const shortCommitLen = 12
+
 // ShortCommit returns the first 12 chars of the commit hash, or the
 // whole string if it's shorter (e.g. "unknown").
 func (g *Globals) ShortCommit() string {
-	if len(g.Commit) > 12 {
-		return g.Commit[:12]
+	if len(g.Commit) > shortCommitLen {
+		return g.Commit[:shortCommitLen]
 	}
 
 	return g.Commit