fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -22,9 +22,6 @@ jobs:
     runs-on: docker
     container:
       image: golang:1.25-alpine
-    # Advisory while the pre-existing lint backlog (~95 findings) is worked
-    # off; flip to blocking by removing continue-on-error once clean.
-    continue-on-error: true
     steps:
       - name: Checkout
         run: |