Configure golangci-lint v2 for the whole tree (brlapi/duckdb build tags, curated linters, documented exclusions) and resolve what it reports: dead code, wrapped-error comparisons and %w wrapping, unclosed websocket handshake bodies, staticcheck SA/S items, ineffectual assignments, and explicit _ = discards for best-effort teardown errors. Document the gate in CONTRIBUTING and AGENTS.