lint(scep): fix CI lint failures in Phase 3 commit (df0a4dd)

Three lint issues from golangci-lint that didn't fire locally because I
ran 'go vet' but not 'staticcheck' before commit (the recent crypto/signer
QF1008 incident pattern repeating — must run staticcheck before
committing per CLAUDE.md::pre-commit-verification-gate; landing this
fixup, then will run staticcheck on every future SCEP-bundle commit).

internal/pkcs7/envelopeddata.go:78
  * ST1022: 'comment on exported var ErrEnvelopedDataDecrypt should be of
    the form "ErrEnvelopedDataDecrypt ..."' — staticcheck enforces the
    Go-doc convention that var/const docs start with the symbol name.
    Renamed the leading 'Sentinel decryption error.' to
    'ErrEnvelopedDataDecrypt is the sentinel decryption error.'

internal/pkcs7/certrep_test.go:246-247
  * U1000: 'func nowMinus1Hour is unused' / 'func nowPlus30Days is unused'
    — left-over helpers from a previous draft of selfSignedCertPEM that
    inlined the time math. Removed both.

Verified with  — clean. Tests still
green (handler 79.0% / service 73.2% / pkcs7 80.5%).

Restores green CI on the lint job for the Phase 3 push.

internal/pkcs7/certrep_test.go

@@ -242,6 +242,3 @@ func selfSignedCertPEM(t *testing.T, cn string) string {
 // testRand returns the system random source. Wrapped here so tests can be
 // adapted to a deterministic source if golden-file tests need it later.
 func testRand() io.Reader { return rand.Reader }
-
-func nowMinus1Hour() time.Time { return time.Now().Add(-time.Hour) }
-func nowPlus30Days() time.Time { return time.Now().Add(30 * 24 * time.Hour) }