deps: batch update 3 dependencies

[wesm]

Consolidates the following dependabot updates:

• Bump DeterminateSystems/nix-installer-action from 21 to 22 #233 -- Bump DeterminateSystems/nix-installer-action from 21 to 22
• Bump actions/setup-go from 6.3.0 to 6.4.0 #234 -- Bump actions/setup-go from 6.3.0 to 6.4.0
• Bump the minor-and-patch group with 2 updates #235 -- Bump the minor-and-patch group with 2 updates (mcp-go v0.46.0, go-sqlite3 v1.14.38)

Also fixes all 343 golangci-lint v2 errcheck/staticcheck warnings that were blocking the pre-commit hook, and updates the nix vendorHash for the new go.sum.

Closes #233, #234, #235

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (ef08fe2)

Verdict: Changes are not clean; there is one medium-severity regression that should be fixed before merge.

Medium

• internal/store/inspect.go:79, internal/store/inspect.go:103
  Replacing defer rows.Close() with defer func() { _ = rows.Close() }() changes closure binding semantics. Because InspectMessage reuses the same rows variable for a later query, both deferred closures can end up closing the second result set, leaking the first. This can leave cursors/statements open on each call.
  Fix: restore defer rows.Close(), or bind the current value explicitly with defer func(r *sql.Rows) { _ = r.Close() }(rows).

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)