ci: add golangci-lint to the build job

[davidtaing]

Problem

The CI gate is gofmt / go vet / go test / go build (.github/workflows/ci.yml)
— no static linter. CodeRabbit's golangci-lint surfaced an errcheck finding
(unchecked fmt.Fprintf) on #60 that the project's own CI can't catch. Adding
golangci-lint closes the gap and catches a useful class of bugs (errcheck,
staticcheck, ineffassign, unused) before review.

Scope (decisions pre-made — this should be turnkey)

1. Add .golangci.yml with a lean linter set — golangci-lint defaults
   (errcheck, ineffassign, staticcheck, unused). Drop govet from golangci since
   go vet ./... already runs separately. No style/opinionated linters — this
   is a weekend project; the goal is real bugs, not churn.

2. errcheck on best-effort writes — exclude, don't thread. The renderer writes
   to stdout / a strings.Builder and deliberately ignores fmt.Fprint* errors
   (16 sites across render.go/watch.go; Go's runtime already exits cleanly on a
   closed stdout pipe via SIGPIPE). Configure errcheck to exclude the fmt.Fprint*
   family via linters-settings.errcheck.exclude-functions
   (fmt.Fprint, fmt.Fprintf, fmt.Fprintln), with a comment noting it's an
   intentional best-effort pattern. Do not thread errors through the render
   paths. (Context: resolved thread on feat: show the open PR number on each worktree row #60.)

3. Install the binary in a run step — not a third-party Action. The repo's
   Actions policy only allows GitHub-owned + select actions (see the changes-job
   comment in ci.yml), so golangci/golangci-lint-action will likely be blocked.
   Install via the official script to a pinned version, e.g.:

   curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh \
     | sh -s -- -b "$(go env GOPATH)/bin" v1.64.8
   golangci-lint run ./...

   (Pin to a current release; verify it supports the repo's Go 1.26.)

4. Placement: add the lint step to the existing build matrix job (after
   go vet), so it runs on ubuntu + macos and automatically inherits the
   changes docs/config skip and the aggregating required ci job. No
   branch-protection change needed — a lint failure fails build, which fails
   ci.

Acceptance

• golangci-lint run ./... passes locally and in CI on ubuntu-latest + macos-latest.
• .golangci.yml documents the fmt.Fprint* errcheck exclusion.
• Any other findings the linter surfaces are fixed minimally (or excluded with a
  documented reason if they're a deliberate pattern) — no broad refactors.
• Purely tooling: no change to treetop's behaviour.

Pointers

• .github/workflows/ci.yml — the build job (add the step), and the changes /
  ci gate structure to respect.
• render.go / watch.go — the 16 best-effort fmt.Fprint* sites behind the
  errcheck exclusion.
• PR feat: show the open PR number on each worktree row #60's resolved CodeRabbit thread — rationale for the exclusion.