Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/types/types.go

@@ -1,16 +1,26 @@
-// Package types provides custom types for better type safety across the vaultik codebase.
-// Using distinct types for IDs, hashes, paths, and credentials prevents accidental
-// mixing of semantically different values that happen to share the same underlying type.
+// Package types provides custom types for better type safety across the
+// vaultik codebase. Using distinct types for IDs, hashes, paths, and
+// credentials prevents accidental mixing of semantically different values
+// that happen to share the same underlying type.
 package types
 
 import (
 	"database/sql/driver"
+	"errors"
 	"fmt"
 
 	"github.com/google/uuid"
 )
 
+// errCannotScan is returned when a database value cannot be scanned into
+// an ID type.
+var errCannotScan = errors.New("cannot scan value")
+
 // FileID is a UUID identifying a file record in the database.
+//
+// used on values.
+//
+//nolint:recvcheck // Scan requires a pointer receiver; String/Value are
 type FileID uuid.UUID
 
 // NewFileID generates a new random FileID.
@@ -54,7 +64,7 @@ func (id *FileID) Scan(src any) error {
 	case []byte:
 		s = string(v)
 	default:
-		return fmt.Errorf("cannot scan %T into FileID", src)
+		return fmt.Errorf("%w: %T into FileID", errCannotScan, src)
 	}
 
 	parsed, err := uuid.Parse(s)
@@ -69,6 +79,10 @@ func (id *FileID) Scan(src any) error {
 
 // BlobID is a UUID identifying a blob record in the database.
 // This is distinct from BlobHash which is the content-addressed hash of the blob.
+//
+// used on values.
+//
+//nolint:recvcheck // Scan requires a pointer receiver; String/Value are
 type BlobID uuid.UUID
 
 // NewBlobID generates a new random BlobID.
@@ -112,7 +126,7 @@ func (id *BlobID) Scan(src any) error {
 	case []byte:
 		s = string(v)
 	default:
-		return fmt.Errorf("cannot scan %T into BlobID", src)
+		return fmt.Errorf("%w: %T into BlobID", errCannotScan, src)
 	}
 
 	parsed, err := uuid.Parse(s)
@@ -208,6 +222,8 @@ func (p GlobPattern) String() string    { return string(p) }
 func (k AgeSecretKey) String() string       { return "[REDACTED]" }
 func (k AWSSecretAccessKey) String() string { return "[REDACTED]" }
 
-// Raw returns the actual value for sensitive types when explicitly needed
-func (k AgeSecretKey) Raw() string       { return string(k) }
+// Raw returns the actual value for sensitive types when explicitly needed.
+func (k AgeSecretKey) Raw() string { return string(k) }
+
+// Raw returns the actual value for sensitive types when explicitly needed.
 func (k AWSSecretAccessKey) Raw() string { return string(k) }