Finish the lint remediation: script/cibuild exits 0 (closes #61)

Clears the final 80 golangci-lint findings under the canonical
.golangci.yml (sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb),
taking the repo from red to green: script/cibuild exits 0.

- wsl_v5 (60): blank line above defer/go statements sharing no variable
  with the line above; blank-line-only diff.
- sqlclosecheck (10): the package-local CloseRows helper hid the close
  from the analyzer. Helper removed; all 18 call sites now defer an
  inline rows.Close(), preserving the fatal-on-close-error path. No
  resource leak existed - the rows were always being closed.
- prealloc (3): append targets given a starting capacity.
- revive (3): package-name findings suppressed with per-site directives
  pending the naming decision tracked in #76.

No gosec suppressions are needed under the pinned linter. .golangci.yml,
Dockerfile, Makefile, .gitea/ and script/ are byte-identical to main.

Verified with script/cibuild (digest-pinned golangci-lint v2.12.2), not
make check - the latter resolves the linter from PATH and is not a
trustworthy gate here; see #78.

Closes #59.

internal/snapshot/backup_test.go

@@ -461,6 +461,7 @@ func (b *BackupEngine) backupOneFile(
 	if err != nil {
 		return err
 	}
+
 	defer func() {
 		err := f.Close()
 		if err != nil {

internal/snapshot/file_change_test.go

@@ -75,6 +75,7 @@ func TestFileContentChange(t *testing.T) {
 	db, err := database.NewTestDB()
 
 	require.NoError(t, err)
+
 	defer func() {
 		err := db.Close()
 		if err != nil {
@@ -165,6 +166,7 @@ func TestMultipleFileChanges(t *testing.T) {
 	db, err := database.NewTestDB()
 
 	require.NoError(t, err)
+
 	defer func() {
 		err := db.Close()
 		if err != nil {

internal/snapshot/progress.go

@@ -127,6 +127,7 @@ func NewProgressReporter() *ProgressReporter {
 // Start begins the progress reporting
 func (pr *ProgressReporter) Start() {
 	pr.wg.Add(1)
+
 	go pr.run()
 
 	// Print initial multi-line status

internal/snapshot/scanner.go

@@ -624,11 +624,12 @@ func (s *Scanner) collectBatchFlushData(
 
 	collectStart := time.Now()
 
-	var (
-		allFileChunks []database.FileChunk
-		allChunkFiles []database.ChunkFile
-	)
-
+	// A pending file contributes one mapping of each kind per chunk, and
+	// an empty file contributes none, so the file count is only a rough
+	// starting capacity for the mapping slices; append grows them as
+	// needed. It is exact for the file and file-ID slices.
+	allFileChunks := make([]database.FileChunk, 0, len(canFlush))
+	allChunkFiles := make([]database.ChunkFile, 0, len(canFlush))
 	allFileIDs := make([]types.FileID, 0, len(canFlush))
 	allFiles := make([]*database.File, 0, len(canFlush))
 
@@ -1673,6 +1674,7 @@ func (s *Scanner) processFileStreaming(
 	if err != nil {
 		return fmt.Errorf("opening file: %w", wrapPermissionError(fileToProcess.Path, err))
 	}
+
 	defer func() { _ = file.Close() }()
 
 	var chunks []streamingChunkInfo

internal/snapshot/scanner_test.go

@@ -164,6 +164,7 @@ func TestScannerSimpleDirectory(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to create test database: %v", err)
 	}
+
 	defer func() {
 		err := db.Close()
 		if err != nil {
@@ -241,6 +242,7 @@ func TestScannerLargeFile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to create test database: %v", err)
 	}
+
 	defer func() {
 		err := db.Close()
 		if err != nil {

internal/snapshot/snapshot.go

@@ -259,6 +259,7 @@ func (sm *SnapshotManager) ExportSnapshotMetadata(
 	}
 
 	log.Debug("Created temporary directory", "path", tempDir)
+
 	defer func() {
 		log.Debug("Cleaning up temporary directory", "path", tempDir)
 
@@ -555,6 +556,7 @@ func (sm *SnapshotManager) cleanSnapshotDB(
 	if err != nil {
 		return nil, fmt.Errorf("opening temp database: %w", err)
 	}
+
 	defer func() {
 		err := db.Close()
 		if err != nil {
@@ -567,6 +569,7 @@ func (sm *SnapshotManager) cleanSnapshotDB(
 	if err != nil {
 		return nil, fmt.Errorf("beginning transaction: %w", err)
 	}
+
 	defer func() {
 		rbErr := tx.Rollback()
 		if rbErr != nil && !errors.Is(rbErr, sql.ErrTxDone) {
@@ -685,6 +688,7 @@ func (sm *SnapshotManager) compressFile(inputPath, outputPath string) error {
 	if err != nil {
 		return fmt.Errorf("opening input file: %w", err)
 	}
+
 	defer func() {
 		err := input.Close()
 		if err != nil {
@@ -696,6 +700,7 @@ func (sm *SnapshotManager) compressFile(inputPath, outputPath string) error {
 	if err != nil {
 		return fmt.Errorf("creating output file: %w", err)
 	}
+
 	defer func() {
 		err := output.Close()
 		if err != nil {
@@ -714,6 +719,7 @@ func (sm *SnapshotManager) compressFile(inputPath, outputPath string) error {
 
 	// Track if writer has been closed to avoid double-close
 	writerClosed := false
+
 	defer func() {
 		if !writerClosed {
 			err := writer.Close()
@@ -749,6 +755,7 @@ func (sm *SnapshotManager) copyFile(src, dst string) error {
 	if err != nil {
 		return err
 	}
+
 	defer func() {
 		log.Debug("Closing source file", "path", src)
 
@@ -764,6 +771,7 @@ func (sm *SnapshotManager) copyFile(src, dst string) error {
 	if err != nil {
 		return err
 	}
+
 	defer func() {
 		log.Debug("Closing destination file", "path", dst)
 
@@ -794,6 +802,7 @@ func (sm *SnapshotManager) generateBlobManifest(
 	if err != nil {
 		return nil, fmt.Errorf("opening database: %w", err)
 	}
+
 	defer func() { _ = db.Close() }()
 
 	// Create repositories to access the data

internal/snapshot/snapshot_test.go

@@ -25,12 +25,14 @@ func copyFile(fs afero.Fs, src, dst string) error {
 	if err != nil {
 		return err
 	}
+
 	defer func() { _ = sourceFile.Close() }()
 
 	destFile, err := fs.Create(dst)
 	if err != nil {
 		return err
 	}
+
 	defer func() { _ = destFile.Close() }()
 
 	_, err = io.Copy(destFile, sourceFile)
@@ -53,6 +55,7 @@ func verifyCleanedDB(
 	if err != nil {
 		t.Fatalf("failed to open cleaned database: %v", err)
 	}
+
 	defer func() {
 		err := cleanedDB.Close()
 		if err != nil {