Add golangci-lint gate and fix its findings

Configure golangci-lint v2 for the whole tree (brlapi/duckdb build tags, curated linters, documented exclusions) and resolve what it reports: dead code, wrapped-error comparisons and %w wrapping, unclosed websocket handshake bodies, staticcheck SA/S items, ineffectual assignments, and explicit _ = discards for best-effort teardown errors. Document the gate in CONTRIBUTING and AGENTS.

internal/app/tentacle_management.go

@@ -138,7 +138,7 @@ func (runtime *tentacleRuntime) Manage(ctx context.Context, request tentacle.Man
 		if err != nil {
 			return err
 		}
-		defer prepared.Discard()
+		defer func() { _ = prepared.Discard() }()
 		operation := "add"
 		if request.Action == "upgrade" {
 			operation = "update"