fix: clear rowserrcheck and sqlclosecheck; add scoped tier 4 silences

[alanwiss]

Summary

Cleans the inherited test code: removes 27 real-bug lint findings
(rowserrcheck, sqlclosecheck) and silences 200+ documented
false positives in .golangci.yml so future PRs see only signal.

Numbers

• Repo lint debt: 413 → 170 issues (−243)
• Touched files: 0 issues under strict --whole-files mode

What changed

• for rows.Next() loops now check rows.Err(); rows/stmts deferred
• db.Exec("drop table foo") → DROP TABLE IF EXISTS with checked error
• errors.Is/As instead of ==/type assertions
• io/ioutil migrated to os / io (deprecated since Go 1.19)
• .golangci.yml: scoped silences for documented false positives
  (e.g. errcheck on database/sql Close, gosec G104 in tests,
  SHA1/MD5 in sqlite3_func_crypt.go per SQLite UserAuth contract)
• CONTRIBUTING.md: new Code conventions section

Validation

• All tests pass under -race
• Out-of-tree harness:
  • 4-hour soak (98M ops, 16 workers): 0 errors, RSS slope ≈ 0
  • 50× SIGKILL crash injection: 0 corruptions, exact recovery
  • AddressSanitizer (cgo memory): 0 violations
  • 10k property-based crypto roundtrips: 100% pass, 0 wrong-key accepts

Caveats

• 3 //nolint remain — each with rationale (godoc Example, test discard
  on failure path, controlled-bounds uint→int64 in custom SQL fn)
• sqlite3_opt_vtable_test.go not touched (behind +build sqlite_vtable)