lint runs on every leg, and gates over dead code and staticcheck's correctness checks

[enesismail]

What was wrong. No CI leg had golangci-lint, so make lint printed "golangci-lint not installed; skipping lint" inside every make ci step, and lint ran nowhere. Nothing said so except that line.

What changes.

• The workflow installs golangci-lint 2.14.0 on every leg before make ci, with go install at an exact version: the install is checked against the checksum database, and the linter is built by the same Go the leg tests with. The step prints the version it installed.
• On CI, make lint treats an absent linter as a failure that names it; on a machine without it, it still skips, with the same line. It prints every finding: the linter's caps per linter and per message, and its rule of one finding per line, are off.
• .golangci.yml enables unused and staticcheck's correctness checks, and nothing else.
• The five real findings are fixed. A guard that holds every git invocation to a deadline read its package with the deprecated parser.ParseDir; it now parses each non-test file itself, so a file built only for another platform is still read. Four dead declarations are gone.
• Two lines that exist to prove something carry //nolint:<linter> // <reason>: the %s of a whole config through an any in the unknown-fields leak test, and the stall-window floor for a leg with nothing recorded.
• CLAUDE.md records the posture: lint gates, over those two classes, and why.
• CLAUDE.md's record of the merge queue gains one observed fact: the queue refuses to enqueue a pull request whose head commit carries a failing run of a required check, even when another run of that check on the same commit is green.

The measurement behind the set. The linter's default set, run with every finding printed, reported the same 110 findings on all three legs:

class	findings	what they were
errcheck	93	all false: writes to a terminal or a report stream the program cannot act on, and closes of handles opened only for reading
staticcheck's style families	10	nine rewrites of code that already reads clearly; one would have removed the %s path from a redaction test's positive control
unused, and staticcheck's correctness checks	7	all signal: five fixed here, two annotated

With this configuration the tree reports none.

Rows and runs.

• Locally, with no linter on PATH: with CI unset the target prints the skip line and exits 0; with CI=true it exits non-zero, naming the linter.
• On CI, before the set was narrowed, every leg printed the installed version, never printed the skip line, and failed at lint on the 110.
• A run with the install step removed on the Linux leg failed there at lint, with the message naming the missing linter, and not at the skip.

Mutations, each run and reverted.

• make lint made to skip under CI=true: the local row's second half reds.
• A second caller of the undeadlined git call, once in an ordinary file and once in a file only Windows builds: the deadline guard reds naming each, which is the per-file parse keeping the guard's field of view.