build(ci): add staticcheck to CI pipeline; fix SA4006 in gitutil test

Add `go tool staticcheck ./...` between vet and test in the `task ci`
pipeline. Fix the SA4006 finding it surfaced: the PlainOpen error in
TestLatestTagTagsIterFails was assigned but never read (the nil check was
lost when the skip logic was simplified).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/gitutil/gitutil_test.go

@@ -765,6 +765,9 @@ func TestLatestTagTagsIterFails(t *testing.T) {
 
 	// Reopen so the filesystem storer holds no cached state.
 	repo2, err := gogit.PlainOpen(dir)
+	if err != nil {
+		t.Fatalf("PlainOpen: %v", err)
+	}
 
 	_, _, err = LatestTag(repo2, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})
 	if err == nil {