Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/snapshot/permission_error_test.go

@@ -1,3 +1,4 @@
+//nolint:testpackage // needs access to unexported wrapPermissionError
 package snapshot
 
 import (
@@ -9,12 +10,15 @@ import (
 	"testing"
 )
 
-func TestWrapPermissionError(t *testing.T) {
-	// Non-permission errors pass through unchanged.
-	plain := errors.New("disk on fire")
+// errDiskOnFire is a non-permission sentinel used to verify pass-through.
+var errDiskOnFire = errors.New("disk on fire")
 
-	got := wrapPermissionError("/some/path", plain)
-	if !errors.Is(got, plain) {
+func TestWrapPermissionError(t *testing.T) {
+	t.Parallel()
+
+	// Non-permission errors pass through unchanged.
+	got := wrapPermissionError("/some/path", errDiskOnFire)
+	if !errors.Is(got, errDiskOnFire) {
 		t.Errorf("non-permission error should pass through, got %v", got)
 	}
 
@@ -32,15 +36,16 @@ func TestWrapPermissionError(t *testing.T) {
 
 	if runtime.GOOS == "darwin" {
 		if !strings.Contains(wrapped.Error(), "Full Disk Access") {
-			t.Errorf("macOS permission error should mention Full Disk Access:\n%s", wrapped.Error())
+			t.Errorf("macOS permission error should mention Full Disk Access:\n%s",
+				wrapped.Error())
 		}
 
 		if !strings.Contains(wrapped.Error(), "System Settings") {
-			t.Errorf("macOS permission error should point at System Settings:\n%s", wrapped.Error())
-		}
-	} else {
-		if !strings.Contains(wrapped.Error(), "--skip-errors") {
-			t.Errorf("non-macOS permission error should mention --skip-errors:\n%s", wrapped.Error())
+			t.Errorf("macOS permission error should point at System Settings:\n%s",
+				wrapped.Error())
 		}
+	} else if !strings.Contains(wrapped.Error(), "--skip-errors") {
+		t.Errorf("non-macOS permission error should mention --skip-errors:\n%s",
+			wrapped.Error())
 	}
 }