Add golangci-lint configuration

[JamieMagee]

We have golangci-lint in the Brewfile but no config file and no CI integration. Running it with defaults catches real bugs (errcheck, govet, staticcheck, etc.) but there's no agreed-upon set of linters or any enforcement.

Proposal:

• Check in a .golangci.yml with the standard linter set plus a few useful extras (bodyclose, errorlint, gosec, noctx, etc.)
• Fix or suppress existing findings so the baseline is clean
• Add a golangci-lint run step to CI so regressions get caught

Without a config, everyone either runs different linters locally or doesn't run them at all.