Finish the lint remediation: script/cibuild exits 0 (closes #61)

Clears the final 80 golangci-lint findings under the canonical
.golangci.yml (sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb),
taking the repo from red to green: script/cibuild exits 0.

- wsl_v5 (60): blank line above defer/go statements sharing no variable
  with the line above; blank-line-only diff.
- sqlclosecheck (10): the package-local CloseRows helper hid the close
  from the analyzer. Helper removed; all 18 call sites now defer an
  inline rows.Close(), preserving the fatal-on-close-error path. No
  resource leak existed - the rows were always being closed.
- prealloc (3): append targets given a starting capacity.
- revive (3): package-name findings suppressed with per-site directives
  pending the naming decision tracked in #76.

No gosec suppressions are needed under the pinned linter. .golangci.yml,
Dockerfile, Makefile, .gitea/ and script/ are byte-identical to main.

Verified with script/cibuild (digest-pinned golangci-lint v2.12.2), not
make check - the latter resolves the linter from PATH and is not a
trustworthy gate here; see #78.

Closes #59.

internal/vaultik/blobcache.go

@@ -238,6 +238,7 @@ func (c *blobDiskCache) ReadAt(key string, offset, length int64) ([]byte, error)
 	if err != nil {
 		return nil, err
 	}
+
 	defer func() { _ = f.Close() }()
 
 	buf := make([]byte, length)

internal/vaultik/blobcache_test.go

@@ -14,6 +14,7 @@ func TestBlobDiskCache_BasicGetPut(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer func() { _ = cache.Close() }()
 
 	data := []byte("hello world")
@@ -79,6 +80,7 @@ func TestBlobDiskCache_OversizedEntryRejected(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer func() { _ = cache.Close() }()
 
 	data := make([]byte, 200)
@@ -100,6 +102,7 @@ func TestBlobDiskCache_UpdateInPlace(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer func() { _ = cache.Close() }()
 
 	err = cache.Put("key1", []byte("v1"))
@@ -137,6 +140,7 @@ func TestBlobDiskCache_ReadAt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer func() { _ = cache.Close() }()
 
 	data := make([]byte, 1024)
@@ -197,6 +201,7 @@ func TestBlobDiskCache_LRUOrder(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer func() { _ = cache.Close() }()
 
 	d := make([]byte, 100)

internal/vaultik/integration_test.go

@@ -134,6 +134,7 @@ func (m *MockStorer) ListStream(
 	_ context.Context, prefix string,
 ) <-chan storage.ObjectInfo {
 	ch := make(chan storage.ObjectInfo)
+
 	go func() {
 		defer close(ch)
 
@@ -326,6 +327,7 @@ func TestEndToEndBackup(t *testing.T) {
 	db, err := database.New(ctx, ":memory:")
 
 	require.NoError(t, err)
+
 	defer func() {
 		err := db.Close()
 		if err != nil {
@@ -411,6 +413,7 @@ func TestBackupAndVerify(t *testing.T) {
 	db, err := database.New(ctx, ":memory:")
 
 	require.NoError(t, err)
+
 	defer func() {
 		err := db.Close()
 		if err != nil {
@@ -968,6 +971,7 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 
 	env := setupDedupBackupEnv(
 		ctx, t, fs, storeDir, dbPath, chunkSize, maxBlobSize)
+
 	defer func() { _ = env.db.Close() }()
 
 	cfg, storer, repos, sm := env.cfg, env.storer, env.repos, env.sm

internal/vaultik/restore.go

@@ -590,6 +590,7 @@ func (v *Vaultik) downloadSnapshotDB(
 	if err != nil {
 		return nil, fmt.Errorf("downloading %s: %w", dbKey, err)
 	}
+
 	defer func() { _ = reader.Close() }()
 
 	// Read all data
@@ -606,6 +607,7 @@ func (v *Vaultik) downloadSnapshotDB(
 	if err != nil {
 		return nil, fmt.Errorf("creating decryption reader: %w", err)
 	}
+
 	defer func() { _ = blobReader.Close() }()
 
 	// Read the binary SQLite database
@@ -1115,6 +1117,7 @@ func (v *Vaultik) verifyFile(
 	if err != nil {
 		return 0, fmt.Errorf("opening file: %w", err)
 	}
+
 	defer func() { _ = f.Close() }()
 
 	// Verify each chunk

internal/vaultik/restore_sweeper.go

@@ -110,6 +110,7 @@ func (s *restoreSweeper) blobStillNeeded(blobHash string) (bool, error) {
 	if err != nil {
 		return true, fmt.Errorf("querying referencing files: %w", err)
 	}
+
 	defer func() { _ = rows.Close() }()
 
 	for rows.Next() {

internal/vaultik/snapshot.go

@@ -1130,6 +1130,7 @@ func (v *Vaultik) downloadManifestByKey(remoteKey string) (*snapshot.Manifest, e
 	if err != nil {
 		return nil, err
 	}
+
 	defer func() { _ = reader.Close() }()
 
 	manifest, err := snapshot.DecodeManifest(reader)

internal/vaultik/verify.go

@@ -96,6 +96,7 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 	if err != nil {
 		return err
 	}
+
 	defer func() {
 		if tempDB != nil {
 			_ = tempDB.Close()
@@ -343,6 +344,7 @@ func (v *Vaultik) verifyBlob(blobInfo snapshot.BlobInfo, db *sql.DB) error {
 	if err != nil {
 		return fmt.Errorf("failed to download: %w", err)
 	}
+
 	defer func() { _ = reader.Close() }()
 
 	// Get decryptor