fix(lint): resolve govet, wrapcheck, and wsl issues

- Fix variable shadowing in test files (err -> mkdirErr/writeErr)
- Wrap errors from external packages with fmt.Errorf
- Add blank lines between statements per wsl requirements
- Fix ineffectual assignment in root.go

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: salmonumbrella

internal/cmd/root.go

@@ -173,8 +173,8 @@ func helpDescription() string {
 		configLine = configPath
 	}
 
+	var backendLine string
 	backendInfo, err := secrets.ResolveKeyringBackendInfo()
-	backendLine := "unknown"
 	if err != nil {
 		backendLine = fmt.Sprintf("error: %v", err)
 	} else {

internal/config/config.go

@@ -32,7 +32,8 @@ func ConfigExists() (bool, error) {
 		if os.IsNotExist(statErr) {
 			return false, nil
 		}
-		return false, statErr
+
+		return false, fmt.Errorf("stat config: %w", statErr)
 	}
 
 	return true, nil
@@ -49,6 +50,7 @@ func ReadConfig() (File, error) {
 		if os.IsNotExist(err) {
 			return File{}, nil
 		}
+
 		return File{}, fmt.Errorf("read config: %w", err)
 	}
 
@@ -58,5 +60,6 @@ func ReadConfig() (File, error) {
 	}
 
 	cfg.KeyringBackend = strings.ToLower(strings.TrimSpace(cfg.KeyringBackend))
+
 	return cfg, nil
 }

internal/config/config_test.go

@@ -16,9 +16,11 @@ func TestConfigPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ConfigPath: %v", err)
 	}
+
 	if filepath.Base(path) != "config.json" {
 		t.Fatalf("unexpected config file: %q", filepath.Base(path))
 	}
+
 	if filepath.Base(filepath.Dir(path)) != AppName {
 		t.Fatalf("unexpected config dir: %q", filepath.Dir(path))
 	}
@@ -33,6 +35,7 @@ func TestReadConfig_Missing(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ReadConfig: %v", err)
 	}
+
 	if cfg.KeyringBackend != "" {
 		t.Fatalf("expected empty config, got %q", cfg.KeyringBackend)
 	}
@@ -47,21 +50,25 @@ func TestReadConfig_JSON5(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ConfigPath: %v", err)
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		t.Fatalf("mkdir: %v", err)
+
+	if mkdirErr := os.MkdirAll(filepath.Dir(path), 0o700); mkdirErr != nil {
+		t.Fatalf("mkdir: %v", mkdirErr)
 	}
+
 	data := `{
   // allow comments + trailing commas
   keyring_backend: "file",
 }`
-	if err := os.WriteFile(path, []byte(data), 0o600); err != nil {
-		t.Fatalf("write config: %v", err)
+
+	if writeErr := os.WriteFile(path, []byte(data), 0o600); writeErr != nil {
+		t.Fatalf("write config: %v", writeErr)
 	}
 
 	cfg, err := ReadConfig()
 	if err != nil {
 		t.Fatalf("ReadConfig: %v", err)
 	}
+
 	if got := strings.TrimSpace(cfg.KeyringBackend); got != "file" {
 		t.Fatalf("expected keyring_backend=file, got %q", got)
 	}

internal/secrets/store.go

@@ -67,8 +67,9 @@ func ResolveKeyringBackendInfo() (KeyringBackendInfo, error) {
 
 	cfg, err := config.ReadConfig()
 	if err != nil {
-		return KeyringBackendInfo{}, err
+		return KeyringBackendInfo{}, fmt.Errorf("read config: %w", err)
 	}
+
 	if cfg.KeyringBackend != "" {
 		return KeyringBackendInfo{Value: cfg.KeyringBackend, Source: keyringBackendSourceConfig}, nil
 	}

internal/secrets/store_test.go

@@ -19,9 +19,11 @@ func TestResolveKeyringBackendInfo_Default(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ResolveKeyringBackendInfo: %v", err)
 	}
+
 	if info.Value != "auto" {
 		t.Fatalf("expected auto, got %q", info.Value)
 	}
+
 	if info.Source != keyringBackendSourceDefault {
 		t.Fatalf("expected source default, got %q", info.Source)
 	}
@@ -37,20 +39,24 @@ func TestResolveKeyringBackendInfo_Config(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ConfigPath: %v", err)
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		t.Fatalf("mkdir: %v", err)
+
+	if mkdirErr := os.MkdirAll(filepath.Dir(path), 0o700); mkdirErr != nil {
+		t.Fatalf("mkdir: %v", mkdirErr)
 	}
-	if err := os.WriteFile(path, []byte(`{ keyring_backend: "file" }`), 0o600); err != nil {
-		t.Fatalf("write config: %v", err)
+
+	if writeErr := os.WriteFile(path, []byte(`{ keyring_backend: "file" }`), 0o600); writeErr != nil {
+		t.Fatalf("write config: %v", writeErr)
 	}
 
 	info, err := ResolveKeyringBackendInfo()
 	if err != nil {
 		t.Fatalf("ResolveKeyringBackendInfo: %v", err)
 	}
+
 	if info.Value != "file" {
 		t.Fatalf("expected file, got %q", info.Value)
 	}
+
 	if info.Source != keyringBackendSourceConfig {
 		t.Fatalf("expected source config, got %q", info.Source)
 	}
@@ -66,20 +72,24 @@ func TestResolveKeyringBackendInfo_EnvOverridesConfig(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ConfigPath: %v", err)
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		t.Fatalf("mkdir: %v", err)
+
+	if mkdirErr := os.MkdirAll(filepath.Dir(path), 0o700); mkdirErr != nil {
+		t.Fatalf("mkdir: %v", mkdirErr)
 	}
-	if err := os.WriteFile(path, []byte(`{ keyring_backend: "file" }`), 0o600); err != nil {
-		t.Fatalf("write config: %v", err)
+
+	if writeErr := os.WriteFile(path, []byte(`{ keyring_backend: "file" }`), 0o600); writeErr != nil {
+		t.Fatalf("write config: %v", writeErr)
 	}
 
 	info, err := ResolveKeyringBackendInfo()
 	if err != nil {
 		t.Fatalf("ResolveKeyringBackendInfo: %v", err)
 	}
+
 	if info.Value != "keychain" {
 		t.Fatalf("expected keychain, got %q", info.Value)
 	}
+
 	if info.Source != keyringBackendSourceEnv {
 		t.Fatalf("expected source env, got %q", info.Source)
 	}
@@ -90,6 +100,7 @@ func TestAllowedBackends_Invalid(t *testing.T) {
 	if err == nil {
 		t.Fatalf("expected error")
 	}
+
 	if !errors.Is(err, errInvalidKeyringBackend) {
 		t.Fatalf("expected invalid backend error, got %v", err)
 	}