Explicitly discard ignored errors (_ =) and add CI enforcement

[michelle-clayton-work]

Follow-up to #142 (comment)

Make intentionally discarded error return values explicit using _ =
(e.g., _ = bcrypt.DestroyKey(kh)).

This improves readability and makes it clear that the error is being
intentionally ignored rather than accidentally dropped.

Motivation

• Discarding errors silently in Go is often a source of bugs.
• Writing _ = makes intent explicit to reviewers and future readers.
• This also enables enforcing the pattern via staticcheck (SA4006 / errcheck-style rules)
  to prevent accidental implicit discards in the future.

Scope

• Update cleanup/finalizer paths to explicitly discard errors.
• Add a CI staticcheck step to enforce explicit error discards.

Non-Goals

• This PR does not change runtime behavior.
• No functional changes — clarity and tooling only.