fix(lint): U1000 — delete dead etagRecorder.sentinelMarker method

CI run on master@ed60059e (Phase 6 + lint hotfix) still red. The
golangci-lint step now passes cleanly (0 issues — yesterday's
ST1021 fix landed), but the workflow also has a SEPARATE
`staticcheck ./...` step at the end that runs raw staticcheck
without golangci-lint's directive-resolution layer:

  internal/api/middleware/etag.go:254:24: func
  (*etagRecorder).sentinelMarker is unused (U1000)

Root cause: Phase 6's etag.go shipped a dead no-op method
`func (r *etagRecorder) sentinelMarker() {}` with a `//nolint:unused`
directive. golangci-lint's `unused` linter respects the directive;
raw staticcheck's U1000 does NOT — `//nolint:` is a golangci-lint
convention, not a staticcheck convention (staticcheck uses
`//lint:ignore U1000 reason` syntax).

The comment claimed the method "anchors" documentation about the
`headerWrittenOnWire` field. Reading the actual code: the field is
used directly in `writeHeadersToWire` (line 241); the method is
pure dead code with a misleading comment. Deleting it loses
nothing — the sentinel field stays where it's needed.

Pattern lesson logged in the Tasks-Deferred table:
  golangci-lint's `//nolint:LINTER` directive is a golangci-lint
  invention. Raw staticcheck (or any underlying linter run
  outside golangci-lint) ignores it. The certctl workflow runs
  BOTH golangci-lint AND a standalone `staticcheck ./...` step,
  so any future `//nolint:unused` / `//nolint:staticcheck` use
  needs to be paired with `//lint:ignore U1000` (or equivalent)
  for staticcheck to honor it — OR the code should be deleted /
  exported / actually used.

Verification:
  staticcheck ./... → exit 0, no output (mirrors CI's invocation)
  go vet ./internal/api/middleware/... → clean
  go test ./internal/api/middleware/... -count=1 -short → ok (0.25s)
  gofmt -l → clean

Closes: CI run on master@ed60059e U1000 lint failure

internal/api/middleware/etag.go

@@ -245,14 +245,6 @@ func (r *etagRecorder) writeHeadersToWire() {
 	r.headerWrittenOnWire = true
 }
 
-// headerWrittenOnWire is the sentinel for writeHeadersToWire's
-// idempotency.
-// (Declared on the struct via a separate field; placed here to
-// keep the struct definition compact above.)
-//
-//nolint:unused // accessed via writeHeadersToWire receiver
-func (r *etagRecorder) sentinelMarker() {}
-
 // flush emits the buffered status + body to the underlying
 // ResponseWriter. Called by the ETag middleware after the handler
 // returns AND the response is either a cache miss (no