fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/queue/local.go

@@ -1,3 +1,6 @@
+// Package queue provides domain.Queue implementations used to buffer
+// notifications between submission and delivery, including an in-memory
+// LocalQueue with optional disk persistence.
 package queue
 
 import (
@@ -129,7 +132,7 @@ func (lq *LocalQueue) Dequeue(ctx context.Context) (*domain.QueueMessage, error)
 }
 
 // Ack acknowledges successful processing of a message
-func (lq *LocalQueue) Ack(ctx context.Context, messageID string) error {
+func (lq *LocalQueue) Ack(_ context.Context, messageID string) error {
 	lq.mu.Lock()
 	defer lq.mu.Unlock()
 
@@ -188,14 +191,14 @@ func (lq *LocalQueue) Nack(ctx context.Context, messageID string, requeue bool)
 }
 
 // Size returns the current number of messages in the queue
-func (lq *LocalQueue) Size(ctx context.Context) (int64, error) {
+func (lq *LocalQueue) Size(_ context.Context) (int64, error) {
 	lq.mu.RLock()
 	defer lq.mu.RUnlock()
 	return int64(len(lq.queue)), nil
 }
 
 // Purge removes all messages from the queue
-func (lq *LocalQueue) Purge(ctx context.Context) error {
+func (lq *LocalQueue) Purge(_ context.Context) error {
 	lq.mu.Lock()
 	defer lq.mu.Unlock()
 
@@ -238,7 +241,7 @@ func (lq *LocalQueue) Close() error {
 }
 
 // HealthCheck verifies the queue is operational
-func (lq *LocalQueue) HealthCheck(ctx context.Context) error {
+func (lq *LocalQueue) HealthCheck(_ context.Context) error {
 	lq.mu.RLock()
 	defer lq.mu.RUnlock()
 
@@ -260,7 +263,7 @@ func (lq *LocalQueue) persistToDiskSync() error {
 		return fmt.Errorf("failed to marshal queue state: %w", err)
 	}
 
-	if err := os.WriteFile(lq.persistPath, data, 0644); err != nil {
+	if err := os.WriteFile(lq.persistPath, data, 0600); err != nil {
 		return fmt.Errorf("failed to write queue state: %w", err)
 	}