fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cmd/client/main.go

@@ -1,3 +1,5 @@
+// Command client is a CLI for sending and managing notifications through
+// the notifier service's REST API.
 package main
 
 import (
@@ -107,7 +109,7 @@ Options:
 	account := fs.String("account", "", "")
 	recipients := fs.String("recipients", "", "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	if *notifType == "" || *body == "" {
 		fmt.Fprintf(os.Stderr, "Error: --type and --body are required\n")
@@ -118,7 +120,7 @@ Options:
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -174,7 +176,7 @@ Options:
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 	id := fs.String("id", "", "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	if *id == "" {
 		fmt.Fprintf(os.Stderr, "Error: --id is required\n")
@@ -185,7 +187,7 @@ Options:
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -231,12 +233,12 @@ Options:
 	limit := fs.Int("limit", 10, "")
 	offset := fs.Int("offset", 0, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -290,12 +292,12 @@ Options:
 	apiKey := fs.String("key", "", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -333,12 +335,12 @@ Options:
 	apiKey := fs.String("key", "", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -374,12 +376,12 @@ Options:
 	baseURL := fs.String("url", "http://localhost:8080", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		Timeout:     *timeout,
 		TLSInsecure: false,
@@ -396,8 +398,7 @@ Options:
 	if healthy {
 		fmt.Println("Service is healthy")
 		os.Exit(0)
-	} else {
-		fmt.Println("Service is unhealthy")
-		os.Exit(1)
 	}
+	fmt.Println("Service is unhealthy")
+	os.Exit(1)
 }