Step 26: Test cleanup.

Tightened lint config (added copyloopvar, durationcheck, makezero,
nilerr, bodyclose). Added 3 combo tests: encrypted+locked files,
dir-only+locked entries, lock/unlock toggle on encrypted entries.
Fixed stale API signatures in ARCHITECTURE.md. All tests already
used t.TempDir() and AddOptions{} consistently.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.golangci.yaml

@@ -8,6 +8,11 @@ linters:
     - unused
     - errorlint
     - staticcheck
+    - copyloopvar
+    - durationcheck
+    - makezero
+    - nilerr
+    - bodyclose
 
 linters-settings:
   errcheck: