Finish the lint remediation: script/cibuild exits 0 (closes #61)

Clears the final 80 golangci-lint findings under the canonical
.golangci.yml (sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb),
taking the repo from red to green: script/cibuild exits 0.

- wsl_v5 (60): blank line above defer/go statements sharing no variable
  with the line above; blank-line-only diff.
- sqlclosecheck (10): the package-local CloseRows helper hid the close
  from the analyzer. Helper removed; all 18 call sites now defer an
  inline rows.Close(), preserving the fatal-on-close-error path. No
  resource leak existed - the rows were always being closed.
- prealloc (3): append targets given a starting capacity.
- revive (3): package-name findings suppressed with per-site directives
  pending the naming decision tracked in #76.

No gosec suppressions are needed under the pinned linter. .golangci.yml,
Dockerfile, Makefile, .gitea/ and script/ are byte-identical to main.

Verified with script/cibuild (digest-pinned golangci-lint v2.12.2), not
make check - the latter resolves the linter from PATH and is not a
trustworthy gate here; see #78.

Closes #59.

internal/s3/client_test.go

@@ -12,6 +12,7 @@ import (
 //nolint:paralleltest // test servers share a fixed localhost port
 func TestClient(t *testing.T) {
 	ts := NewTestServer(t)
+
 	defer func() {
 		err := ts.Cleanup()
 		if err != nil {
@@ -58,6 +59,7 @@ func verifyPutGetHead(
 	if err != nil {
 		t.Fatalf("failed to get object: %v", err)
 	}
+
 	defer func() {
 		err := reader.Close()
 		if err != nil {

internal/s3/s3_test.go

@@ -147,6 +147,7 @@ func (ts *TestServer) Client() *s3.Client {
 //nolint:paralleltest // test servers share a fixed localhost port
 func TestBasicS3Operations(t *testing.T) {
 	ts := NewTestServer(t)
+
 	defer func() {
 		err := ts.Cleanup()
 		if err != nil {
@@ -179,6 +180,7 @@ func TestBasicS3Operations(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to get object: %v", err)
 	}
+
 	defer func() {
 		err := result.Body.Close()
 		if err != nil {
@@ -202,6 +204,7 @@ func TestBasicS3Operations(t *testing.T) {
 //nolint:paralleltest // test servers share a fixed localhost port
 func TestBlobOperations(t *testing.T) {
 	ts := NewTestServer(t)
+
 	defer func() {
 		err := ts.Cleanup()
 		if err != nil {
@@ -268,6 +271,7 @@ func TestBlobOperations(t *testing.T) {
 //nolint:paralleltest // test servers share a fixed localhost port
 func TestMetadataOperations(t *testing.T) {
 	ts := NewTestServer(t)
+
 	defer func() {
 		err := ts.Cleanup()
 		if err != nil {