Unblock npm run ci by burning down repo-wide lint debt and defining a maintainable golangci-lint baseline

[CodeMonkeyCybersecurity]

Summary

npm run ci is still red after the #291-#294 fix set because the lint lane is failing on a large backlog of unrelated issues outside the touched packages.

Evidence

• npm run ci --silent fails in the main workspace and in a clean temporary worktree after replaying only the staged patch set.
• The remaining failures come from unrelated files/packages, including examples like pkg/httpclient/httpclient_test.go, pkg/hecate/api/handlers.go, cmd/backup/*, internal/chatarchivecmd/run.go, and others.
• The clean-worktree run reported 159 lint issues, which indicates this is branch-wide debt rather than a regression introduced by the #291-#294 patch set.

Why this matters

• It blocks the requested workflow contract: commit/push only after npm run ci passes.
• It obscures signal from real regressions by mixing new failures with longstanding debt.

Proposed work

1. Decide whether the repo should enforce repo-wide lint cleanliness or only changed-file cleanliness in PRs.
2. Triage and fix the current backlog, or introduce an explicit temporary baseline with a burn-down plan.
3. Keep using the pinned installer in scripts/ci/install-golangci-lint.sh so tool drift does not mask real failures.
4. Add ownership buckets for the highest-volume packages.

Acceptance criteria

• npm run ci --silent passes from a clean checkout.
• Lint policy is documented and enforced consistently in CI and pre-commit.
• No ad hoc local lint versions are required to get green CI.