fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/logging/logger.go

@@ -1,3 +1,6 @@
+// Package logging provides structured logging backed by log/slog, with UTC
+// RFC3339 timestamps and a level-gated API compatible with the previous
+// *log.Logger-based implementation.
 package logging
 
 import (
@@ -19,6 +22,8 @@ type Logger struct {
 // LogLevel represents the logging level
 type LogLevel int
 
+// Logging levels, in increasing order of severity. DebugLevel is the most
+// verbose and ErrorLevel the least.
 const (
 	DebugLevel LogLevel = iota
 	InfoLevel
@@ -102,7 +107,7 @@ func NewFromOptions(levelStr string, format string, outputPath string) (*Logger,
 	case "stderr":
 		output = os.Stderr
 	default:
-		file, err := os.OpenFile(outputPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+		file, err := os.OpenFile(outputPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600) //nolint:gosec // outputPath is operator-configured (logging.output), not user-controlled input
 		if err != nil {
 			return nil, err
 		}

internal/logging/logger_test.go

@@ -12,16 +12,16 @@ import (
 func TestNew_TextFormat(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "text.log")
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("unexpected error opening file: %v", err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	logger := New(InfoLevel, file)
 	logger.Info("hello world")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read log file: %v", err)
 	}
@@ -49,7 +49,7 @@ func TestNewFromConfig_JSONOutput(t *testing.T) {
 
 	logger.Info("structured message")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read log file: %v", err)
 	}
@@ -77,17 +77,17 @@ func TestNewFromConfig_JSONOutput(t *testing.T) {
 func TestLevelFiltering_DebugSuppressedAtInfo(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "level.log")
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("unexpected error opening file: %v", err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	logger := New(InfoLevel, file)
 	logger.Debug("should not appear")
 	logger.Info("should appear")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read log file: %v", err)
 	}
@@ -112,7 +112,7 @@ func TestNewFromOptions_FileOutput(t *testing.T) {
 
 	logger.Info("file message")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read log file: %v", err)
 	}
@@ -136,7 +136,7 @@ func TestNewFromOptions_FormatSelection(t *testing.T) {
 	}
 	jsonLogger.Info("json message")
 
-	jsonData, err := os.ReadFile(jsonPath)
+	jsonData, err := os.ReadFile(jsonPath) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read json log file: %v", err)
 	}
@@ -151,7 +151,7 @@ func TestNewFromOptions_FormatSelection(t *testing.T) {
 	}
 	textLogger.Info("text message")
 
-	textData, err := os.ReadFile(textPath)
+	textData, err := os.ReadFile(textPath) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read text log file: %v", err)
 	}
@@ -170,7 +170,7 @@ func TestNewFromOptions_FormatSelection(t *testing.T) {
 	}
 	defaultLogger.Info("default message")
 
-	defaultData, err := os.ReadFile(defaultPath)
+	defaultData, err := os.ReadFile(defaultPath) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read default log file: %v", err)
 	}
@@ -186,7 +186,7 @@ func TestNewFromOptions_FormatSelection(t *testing.T) {
 	}
 	configLogger.Info("config message")
 
-	configData, err := os.ReadFile(configPath)
+	configData, err := os.ReadFile(configPath) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read config log file: %v", err)
 	}
@@ -198,11 +198,11 @@ func TestNewFromOptions_FormatSelection(t *testing.T) {
 func TestSlogAccessor(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "slog.log")
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("unexpected error opening file: %v", err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	logger := New(InfoLevel, file)
 	if logger.Slog() == nil {
@@ -211,7 +211,7 @@ func TestSlogAccessor(t *testing.T) {
 
 	logger.Slog().Info("via slog accessor")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // path is from t.TempDir()
 	if err != nil {
 		t.Fatalf("failed to read log file: %v", err)
 	}