fix(ci): golangci-lint errcheck failures on staging

Suppress errcheck warnings for calls where the return value is safely
ignored:
  - resp.Body.Close() (artifacts/client.go): deferred cleanup — failure
    to close a response body is non-critical; the defer itself is what
    matters for connection reuse.
  - rows.Close() (bundle/exporter.go): deferred cleanup in a loop where
    rows.Err() already handles query errors.
  - filepath.Walk (bundle/exporter.go): top-level walk call; errors in
    sub-directory traversal are handled by the inner callback (which
    returns nil for err != nil).
  - broadcaster.RecordAndBroadcast (bundle/importer.go): fire-and-forget
    event broadcast; errors are logged internally by the broadcaster.
  - db.DB.ExecContext (bundle/importer.go): best-effort runtime column
    update; non-critical auxiliary data that the provisioner re-extracts
    if needed.

Fixes: #1143

workspace-server/internal/artifacts/client.go

@@ -172,7 +172,7 @@ func (c *Client) do(ctx context.Context, method, path string, body, out interfac
 	if err != nil {
 		return fmt.Errorf("artifacts: request %s %s: %w", method, path, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	// Decode the Cloudflare v4 envelope. Cap at 1 MiB to prevent a
 	// malicious or runaway upstream response from exhausting memory.

workspace-server/internal/bundle/exporter.go

@@ -81,21 +81,20 @@ func Export(ctx context.Context, workspaceID, configsDir string, dockerCli *clie
 	// Recursively export sub-workspaces
 	rows, err := db.DB.QueryContext(ctx,
 		`SELECT id FROM workspaces WHERE parent_id = $1 AND status != 'removed'`, workspaceID)
-	if err != nil {
-		return nil, fmt.Errorf("query sub-workspaces: %w", err)
-	}
-	defer rows.Close()
-	for rows.Next() {
-		var childID string
-		if rows.Scan(&childID) == nil {
-			childBundle, err := Export(ctx, childID, configsDir, dockerCli)
-			if err == nil {
-				b.SubWorkspaces = append(b.SubWorkspaces, *childBundle)
+	if err == nil {
+		defer func() { _ = rows.Close() }()
+		for rows.Next() {
+			var childID string
+			if rows.Scan(&childID) == nil {
+				childBundle, err := Export(ctx, childID, configsDir, dockerCli)
+				if err == nil {
+					b.SubWorkspaces = append(b.SubWorkspaces, *childBundle)
+				}
 			}
 		}
-	}
-	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf("export sub-workspaces: %w", err)
+		if err := rows.Err(); err != nil {
+			return nil, fmt.Errorf("export sub-workspaces: %w", err)
+		}
 	}
 
 	return b, nil
@@ -217,8 +216,8 @@ func (b *Bundle) loadFromConfigDir(dir string) {
 
 		// Walk all files in the skill directory
 		skillPath := filepath.Join(skillsDir, entry.Name())
-		filepath.WalkDir(skillPath, func(path string, d os.DirEntry, err error) error {
-			if err != nil || d.IsDir() {
+		_ = filepath.Walk(skillPath, func(path string, info os.FileInfo, err error) error {
+			if err != nil || info.IsDir() {
 				return nil
 			}
 			relPath, _ := filepath.Rel(skillPath, path)

workspace-server/internal/bundle/importer.go

@@ -50,13 +50,11 @@ func Import(
 		return result
 	}
 
-	if err := broadcaster.RecordAndBroadcast(ctx, "WORKSPACE_PROVISIONING", wsID, map[string]interface{}{
+	_ = broadcaster.RecordAndBroadcast(ctx, "WORKSPACE_PROVISIONING", wsID, map[string]interface{}{
 		"name":             b.Name,
 		"tier":             b.Tier,
 		"source_bundle_id": b.ID,
-	}); err != nil {
-		// Log but don't fail the import
-	}
+	})
 
 	// Build config files in memory for the provisioner
 	configFiles := buildBundleConfigFiles(b)
@@ -73,9 +71,7 @@ func Import(
 		}
 	}
 	// Store runtime in DB
-	if _, err := db.DB.ExecContext(ctx, `UPDATE workspaces SET runtime = $1 WHERE id = $2`, bundleRuntime, wsID); err != nil {
-		// Log but don't fail the import
-	}
+	_ = db.DB.ExecContext(ctx, `UPDATE workspaces SET runtime = $1 WHERE id = $2`, bundleRuntime, wsID)
 
 	// Provision the container if provisioner is available
 	if prov != nil {