Remove confidence scores from visible output, fix CI lint cache

[dgrieser]

Confidence scores are no longer rendered in terminal output or in published
GitHub/GitLab comments. They remain available in the JSON output and in the
hidden review envelope, so nothing is lost for machine consumers — the visible
feedback just focuses on the verdict badge, the priority badge, and the
explanation.

Chasing the lint failures this surfaced turned up an unrelated CI problem, so
the lint setup is fixed here too.

Visible output

• Drop the overall confidence line from the terminal summary and from the
  published summary comment.
• Drop the per-finding confidence line from terminal findings and from
  published finding comments.
• Delete ConfidencePercent / ConfidenceLine in internal/scm/reviewmd,
  whose last callers are gone.
• Update README.md to state that confidence lives only in --output json
  and in the hidden review envelope.

Tests

• TestTerminalFormatter now fails on any confidence substring in the
  rendered buffer, before the golden compare, so a re-added render path gives a
  named failure rather than an opaque golden diff. Golden file regenerated.
• TestCarrierNotesReassemble asserts OverallConfidenceScore and both
  per-finding scores survive the carrier envelope round-trip. With the visible
  bodies no longer carrying them, the envelope is the only thing keeping those
  scores alive across a re-run.

Lint: cold cache in CI

CI kept failing with staticcheck SA5011 (possible nil pointer dereference) on
test code that lints clean locally, three sites at a time, a different three
each run.

The cause is golangci-lint's analysis cache. SA5011 needs the fact that
(*testing.common).Fatal never returns, which staticcheck derives by analyzing
the testing package. When results are served from a partially populated cache
that fact is missing, t.Fatal looks like an ordinary call, and every
if x == nil { t.Fatal(...) } followed by a dereference is reported. CI's
golangci-lint-action restores a cache between runs and lands in exactly that
state.

Reproduced with the official v2.12.2 binary: populating the cache with
--default=none --enable staticcheck and then running the full config reports
14 issues in internal/review alone; a cold run right after reports none. A
purpose-built probe confirms the cold result is the correct one — it is not
flagged cold, and it is precisely the shape CI was rejecting. Same binary
version, Go toolchain, and issue caps on both sides, so none of those are
involved.

• Pass skip-cache: true to golangci-lint-action so CI analyzes cold, like
  make lint does.
• Lift max-same-issues and max-issues-per-linter, which defaulted to 3 and
  turned one pattern into several rounds of CI failures instead of one list.
• Enable the modernize linter in .golangci.yml, delete the make modernize
  target, and drop the separate go run …/modernize step from CI. One lint
  invocation now covers both locally and in CI.
• make lint runs golangci-lint cache clean first, for the same reason
  skip-cache is set.

Two loop sites in internal/git/history_test.go and cmd/nickpit/main_test.go
keep the t.Errorf + continue they picked up along the way: reporting every
bad element instead of stopping at the first is worth having regardless.