Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/s3/s3_test.go

@@ -3,10 +3,10 @@ package s3_test
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
-	"os"
 	"path/filepath"
 	"testing"
 	"time"
@@ -37,13 +37,16 @@ type TestServer struct {
 	logBuf   *bytes.Buffer
 }
 
+// testServerReadHeaderTimeout bounds header reads on the in-process
+// test server (gosec G112).
+const testServerReadHeaderTimeout = 5 * time.Second
+
 // NewTestServer creates and starts a new test server
 func NewTestServer(t *testing.T) *TestServer {
+	t.Helper()
+
 	// Create temp directory for any file operations
-	tempDir, err := os.MkdirTemp("", "vaultik-s3-test-*")
-	if err != nil {
-		t.Fatalf("failed to create temp dir: %v", err)
-	}
+	tempDir := t.TempDir()
 
 	// Create in-memory backend
 	backend := s3mem.New()
@@ -51,14 +54,15 @@ func NewTestServer(t *testing.T) *TestServer {
 
 	// Create HTTP server
 	server := &http.Server{
-		Addr:    "localhost:9999",
-		Handler: faker.Server(),
+		Addr:              "localhost:9999",
+		Handler:           faker.Server(),
+		ReadHeaderTimeout: testServerReadHeaderTimeout,
 	}
 
 	// Start server in background
 	go func() {
 		err := server.ListenAndServe()
-		if err != nil && err != http.ErrServerClosed {
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
 			t.Logf("test server error: %v", err)
 		}
 	}()
@@ -70,6 +74,14 @@ func NewTestServer(t *testing.T) *TestServer {
 	logBuf := &bytes.Buffer{}
 
 	// Create S3 client with custom logger
+	logFn := func(classification logging.Classification, format string, v ...any) {
+		// Capture logs to buffer instead of stdout
+		fmt.Fprintf(logBuf, "SDK %s %s %s\n",
+			time.Now().Format("2006/01/02 15:04:05"),
+			string(classification),
+			fmt.Sprintf(format, v...))
+	}
+
 	cfg, err := config.LoadDefaultConfig(context.Background(),
 		config.WithRegion(testRegion),
 		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
@@ -77,14 +89,9 @@ func NewTestServer(t *testing.T) *TestServer {
 			testSecretKey,
 			"",
 		)),
-		config.WithClientLogMode(aws.LogRetries|aws.LogRequestWithBody|aws.LogResponseWithBody),
-		config.WithLogger(logging.LoggerFunc(func(classification logging.Classification, format string, v ...any) {
-			// Capture logs to buffer instead of stdout
-			fmt.Fprintf(logBuf, "SDK %s %s %s\n",
-				time.Now().Format("2006/01/02 15:04:05"),
-				string(classification),
-				fmt.Sprintf(format, v...))
-		})),
+		config.WithClientLogMode(
+			aws.LogRetries|aws.LogRequestWithBody|aws.LogResponseWithBody),
+		config.WithLogger(logging.LoggerFunc(logFn)),
 	)
 	if err != nil {
 		t.Fatalf("failed to create AWS config: %v", err)
@@ -121,17 +128,13 @@ func NewTestServer(t *testing.T) *TestServer {
 	return ts
 }
 
-// Cleanup shuts down the server and removes temp directory
+// Cleanup shuts down the server. The temp directory is removed
+// automatically by t.TempDir.
 func (ts *TestServer) Cleanup() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	err := ts.server.Shutdown(ctx)
-	if err != nil {
-		return err
-	}
-
-	return os.RemoveAll(ts.tempDir)
+	return ts.server.Shutdown(ctx)
 }
 
 // Client returns the S3 client configured for the test server
@@ -140,6 +143,8 @@ func (ts *TestServer) Client() *s3.Client {
 }
 
 // TestBasicS3Operations tests basic store and retrieve operations
+//
+//nolint:paralleltest // test servers share a fixed localhost port
 func TestBasicS3Operations(t *testing.T) {
 	ts := NewTestServer(t)
 	defer func() {
@@ -193,6 +198,8 @@ func TestBasicS3Operations(t *testing.T) {
 }
 
 // TestBlobOperations tests blob storage patterns for vaultik
+//
+//nolint:paralleltest // test servers share a fixed localhost port
 func TestBlobOperations(t *testing.T) {
 	ts := NewTestServer(t)
 	defer func() {
@@ -257,6 +264,8 @@ func TestBlobOperations(t *testing.T) {
 }
 
 // TestMetadataOperations tests metadata storage patterns
+//
+//nolint:paralleltest // test servers share a fixed localhost port
 func TestMetadataOperations(t *testing.T) {
 	ts := NewTestServer(t)
 	defer func() {
@@ -286,7 +295,8 @@ func TestMetadataOperations(t *testing.T) {
 
 	// Store manifest
 	manifestKey := filepath.Join("metadata", snapshotID+".manifest.json.zst")
-	manifestData := []byte(`{"snapshot_id":"2024-01-01T12:00:00Z","blob_hashes":["hash1","hash2"]}`)
+	manifestData := []byte(`{"snapshot_id":"2024-01-01T12:00:00Z",` +
+		`"blob_hashes":["hash1","hash2"]}`)
 
 	_, err = client.PutObject(ctx, &s3.PutObjectInput{
 		Bucket: aws.String(testBucket),