fix(ci): satisfy golangci-lint and stabilize browser tests

[MarioRial22]

What

Gets the CI workflow (test + lint + build) green on main. Branched off current main and independent of #103.

Lint (golangci-lint, default linters, no config)

• Migrate the deprecated nhooyr.io/websocket → github.com/coder/websocket (drop-in; identical API) — clears every staticcheck SA1019. Bumps the go directive to 1.23, which the new dependency requires.
• Check previously-ignored error returns (errcheck).
• Use fmt.Fprintf instead of fmt.Fprintln(fmt.Sprintf(...)) (gosimple S1038).
• Drop dead value assignments (staticcheck SA4006).
• Mark intentionally-unused helpers (e.g. the disabled tap-retry path) with //nolint:unused — kept, not deleted.

Test

• The pkg/driver/browser/cdp suite launches headless Chromium, which aborts (SIGABRT in ZygoteHostImpl::Init) on GitHub runners because Chrome's setuid sandbox needs user namespaces those runners restrict. Pass --no-sandbox only when running under CI (CI / MAESTRO_NO_SANDBOX); the production default keeps the sandbox enabled.

The changes are deliberately surgical — no formatting churn, and go.mod/go.sum only swap the one websocket dependency.

Verification (local)

• golangci-lint run ./... → 0 issues
• go build ./... → ok
• CI=true go test ./pkg/driver/browser/cdp/... → full suite passes (was crashing)
• go test -race ./pkg/flutter/... ./pkg/maestro/... ./pkg/driver/devicelab/... ... → pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[omnarayan]

Merged — thank you @MarioRial22. This is the one that mattered most: our CI had been red on every commit for weeks, so the gate wasn't actually protecting anything, and every merge was flying blind. The run on the merge commit is now green across
Test, Lint, and Build for the first time in a long while.

What I appreciated about the approach:

• The --no-sandbox fix is correctly gated on CI/MAESTRO_NO_SANDBOX, so the production default keeps Chrome's sandbox enabled — exactly right.
• Migrating off the deprecated nhooyr.io/websocket to the coder/websocket rename is the better long-term call than suppressing the deprecation, and running -race against the actual websocket consumers (maestro / flutter / devicelab) was the right way
  to de-risk it.
• The errcheck cleanups are all explicit-ignores of errors that were already being dropped, and you kept the intentionally-unused helpers with //nolint:unused rather than deleting them — no behavior change, no churn.

Genuinely high-leverage work — having a trustworthy green baseline makes everything else easier to land. Thanks again.