apply go fix modernizations across the workspace

`go fix` carries the modernize analyzers now, and the tree had drifted behind
them. This is the mechanical result, reviewed rather than trusted: the tool is
capable of rewriting code into something that no longer tests or does what it
did, so every non-test change was read individually and the concurrency-bearing
packages were re-run under -race.

Production code, four changes, all semantics-preserving:

  - leases/manager.go: wg.Add(1) + go + defer wg.Done() becomes wg.Go. The
    comment above that function turns on Add happening before the goroutine
    starts, so that a Wait cannot return before the worker has run. wg.Go does
    the Add synchronously on the calling goroutine, so the invariant it
    describes still holds.
  - auth/token/handler.go: strings.Fields -> strings.FieldsSeq, same splitting,
    iterated rather than allocated.
  - hold/gc/gc.go: a hand-written map copy -> maps.Copy.
  - hold/pds/scan_broadcaster.go: three-clause loop -> range over int.

The rest are tests. The one worth naming is carstore_contention_test.go, where a
careless rewrite could have quietly stopped exercising contention: go fix
converted the reader and side-table goroutines to loopWG.Go but correctly
declined to touch the writer loop, which passes its index as a parameter. The
writer/reader/side-table shape and the stop channel are unchanged, so the test
still contends over the same carstore transactions.

Verified: go build for hold and appview, `make lint` 0 issues, the deploy and
credential-helper modules 0 issues, `make test` green across all 43 packages,
and -race green on leases, hold/pds, hold/gc and auth/token. The scanner module's
two lint findings are unchanged from HEAD and are in files go fix never touched.

Kept separate from the HTTP/2 commit so that one stays readable, and so this can
be reverted on its own if a modernization turns out to matter.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TA9D4DjaLZTvzQ7dJbu4eg

pkg/appview/db/device_store_scan_test.go

@@ -31,7 +31,7 @@ func seedIndexedDeviceRows(t *testing.T, store *DeviceStore, did, handle string,
 		t.Fatalf("GenerateFromPassword: %v", err)
 	}
 
-	for i := 0; i < n; i++ {
+	for i := range n {
 		hash := append([]byte(nil), base...)
 		// Vary the tail so secret_hash stays UNIQUE, keeping the base64 alphabet.
 		hash[len(hash)-1] = byte('a' + (i % 26))

pkg/appview/db/device_store_test.go

@@ -723,7 +723,7 @@ func TestDeviceStore_LegacyDeviceBackfills(t *testing.T) {
 func TestDeviceStore_ValidateDoesNotScanIndexedRows(t *testing.T) {
 	store := setupTestDB(t)
 	createTestUser(t, store, "did:plc:alice123", "alice.bsky.social")
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		newDeviceForTest(t, store, "did:plc:alice123", "alice.bsky.social", fmt.Sprintf("Device %d", i))
 	}
 

pkg/appview/holdpurge/queue_test.go

@@ -282,7 +282,7 @@ func TestSubmitShedsWhenQueueIsFull(t *testing.T) {
 	// One job occupies the worker, one fills the single buffer slot, the
 	// third has nowhere to go.
 	accepted := 0
-	for i := 0; i < 3; i++ {
+	for i := range 3 {
 		if q.Submit(testRequest(fmt.Sprintf("at://did:plc:testuser/io.atcr.manifest/%d", i))) {
 			accepted++
 		}
@@ -315,7 +315,7 @@ func TestWaitDrainsAndDoesNotLeak(t *testing.T) {
 		return nil
 	})
 
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		if !q.Submit(testRequest(fmt.Sprintf("at://did:plc:testuser/io.atcr.manifest/drain%d", i))) {
 			t.Fatalf("Submit %d rejected", i)
 		}

pkg/appview/installscript/installscript_test.go

@@ -209,7 +209,7 @@ func TestCredHelpersKeyIsRegistryNotSite(t *testing.T) {
 
 func offendingLines(s, needle string) string {
 	var out []string
-	for _, line := range strings.Split(s, "\n") {
+	for line := range strings.SplitSeq(s, "\n") {
 		if strings.Contains(line, needle) {
 			out = append(out, "  "+line)
 		}

pkg/appview/leases/manager.go

@@ -126,11 +126,9 @@ var errNotAcquired = errors.New("leases: not acquired")
 // could then return before the worker has even started, let alone released its
 // lease.
 func (m *Manager) Go(ctx context.Context, name string, fn func(context.Context) error) {
-	m.wg.Add(1)
-	go func() {
-		defer m.wg.Done()
+	m.wg.Go(func() {
 		m.Run(ctx, name, fn)
-	}()
+	})
 }
 
 // Wait blocks until every worker started with Go has stopped and released its