build(ci): add staticcheck to CI pipeline; fix SA4006 in gitutil test

Add `go tool staticcheck ./...` between vet and test in the `task ci`
pipeline. Fix the SA4006 finding it surfaced: the PlainOpen error in
TestLatestTagTagsIterFails was assigned but never read (the nil check was
lost when the skip logic was simplified).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Taskfile.yml

@@ -77,7 +77,7 @@ tasks:
       - go test -run='^Fuzz' {{.PKG}}
 
   ci:
-    desc: Full CI pipeline — tidy check, vet, test
+    desc: Full CI pipeline — tidy check, vet, staticcheck, test
     cmds:
       - task: tidy
       - |
@@ -86,6 +86,7 @@ tasks:
           exit 1
         fi
       - task: lint
+      - go tool staticcheck ./...
       - task: test
 
   clean:

internal/gitutil/gitutil_test.go

@@ -765,6 +765,9 @@ func TestLatestTagTagsIterFails(t *testing.T) {
 
 	// Reopen so the filesystem storer holds no cached state.
 	repo2, err := gogit.PlainOpen(dir)
+	if err != nil {
+		t.Fatalf("PlainOpen: %v", err)
+	}
 
 	_, _, err = LatestTag(repo2, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})
 	if err == nil {