chore(lint): clear 13 golangci-lint findings (ag-tcf0.1 #golangci-lint-clear)

[boshu2]

What

Clears all outstanding golangci-lint run findings in cli/ — 13 issues across 8 files. Pure mechanical lint cleanup, no behavior change. (Several were hidden behind golangci-lint's default max-same-issues=3 display cap; running with caps disabled surfaced the full set.)

Linter	Count	Fix
errcheck	7	unchecked f.Close() → defer func() { _ = f.Close() }() / _ = f.Close()
staticcheck S1016	2	struct-literal copy → type conversion (reconcileCIRun(run), reconcileBeadSummary(issue))
staticcheck QF1012	2	b.WriteString(fmt.Sprintf(...)) → fmt.Fprintf(&b, ...)
staticcheck QF1001	1	De Morgan: !(a && b) → `a'
copyloopvar	1	drop redundant fx := fx (Go 1.22+ per-iteration loop var; go.mod is 1.26)

Files: loop_blocked.go, loop_next_work.go, cron_self_adjust.go, reconcile.go, provenance_trace_test.go, internal/canon/ledger.go, internal/scenarios/validate.go, internal/skills/catalog.go.

Verification

• go build ./... ✅ · go vet ./... ✅
• golangci-lint run --max-same-issues 0 --max-issues-per-linter 0 → 0 issues ✅
• go test ./internal/canon/... ./internal/scenarios/... ./internal/skills/... → 116 passed ✅
• targeted cmd/ao tests (provenance/reconcile/cron/blocked/next-work) → ok ✅
• scripts/pre-push-gate.sh --fast → passed ✅

Closes-scenario: ag-tcf0.1#golangci-lint-clear
Bounded-context: BC5-Runtime
Evidence: golangci-lint run --max-same-issues 0 → 0 issues (verified locally; CI re-runs the omnibus gate)