fix(ci): main Build & Test red since 2026-06-11 - pgx CVE GO-2026-5004, errcheck wave, 3 failing internal/config tests #1339

CI - Build & Test has been failing on main since at least 2026-06-11 (latest red run on head 5f712a0, run 28592118645 on PR #1338 shows identical failures on a PR that only adds an inert new package). Three independent failures:

1. Security Scanning (govulncheck): GO-2026-5004, SQL injection via placeholder confusion with dollar-quoted string literals in github.com/jackc/pgx/v5. Reachable at internal/database/connection.go:353 (ReleaseAdvisoryLock -> pgxpool.Conn.QueryRow -> sanitize.SanitizeSQL). Repo is on pgx/v5 v5.8.0; fixed in v5.9.2. Fix: bump root go.mod + go mod tidy, run the full test suite (pgx minor bumps have bitten query sanitization behavior before).

2. Lint (golangci-lint v2.10.1 errcheck): dozens of unchecked-error returns across cmd/cleanup-lambda, cmd/configure_azure.go, cmd/configure_gcp.go, cmd/rekey, internal/api/handler*.go, internal/api/ri_utilization_cache.go, internal/api/validation.go, internal/auth/service_apikeys.go, internal/auth/service_mfa.go, internal/auth/test_helpers.go, internal/commitmentopts/store_postgres.go. Fix for real per repo policy (no gate suppression, no only-new-issues): handle or explicitly propagate each error.

3. Integration tests (internal/config): TestPostgresStore_UpsertRecommendations_AccountScopedEviction, TestPostgresStore_UpsertRecommendations_AmbientAndRegisteredCoexist, and TestPostgresStore_PurchaseExecutions/Get_execution_by_ID_-_not_found (expects an error for a missing execution ID, gets nil; internal/config/store_postgres_test.go:312). Root-cause each: these may be genuine regressions on main, not just flaky tests.

Red main CI blocks meaningful CI signal for every open PR (currently biting #1338 and the rest of the LeanerCloud/cloud-commitments-go#27 laddering series).