all: suppress unused code lint warnings (batch 3)

Add nolint:unused comments to intentionally unused code that may be
useful for future debugging or is kept for backward compatibility:
- Test helper functions in integration tests
- Debug helpers in mapper tests
- Error variables that may be used later
- Functions marked for future use

Also remove actually unused constants and error variables.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

hscontrol/db/node_test.go

@@ -624,6 +624,7 @@ func TestEphemeralGarbageCollectorLoads(t *testing.T) {
 	}
 }
 
+//nolint:unused
 func generateRandomNumber(t *testing.T, max int64) int64 {
 	t.Helper()
 

hscontrol/mapper/batcher_test.go

@@ -130,8 +130,6 @@ const (
 	SMALL_BUFFER_SIZE  = 3
 	TINY_BUFFER_SIZE   = 1 // For maximum contention
 	LARGE_BUFFER_SIZE  = 200
-
-	reservedResponseHeaderSize = 4
 )
 
 // TestData contains all test entities created for a test scenario.
@@ -320,6 +318,8 @@ func (ut *updateTracker) recordUpdate(nodeID types.NodeID, updateSize int) {
 }
 
 // getStats returns a copy of the statistics for a node.
+//
+//nolint:unused
 func (ut *updateTracker) getStats(nodeID types.NodeID) UpdateStats {
 	ut.mu.RLock()
 	defer ut.mu.RUnlock()

hscontrol/mapper/mapper.go

@@ -24,7 +24,6 @@ import (
 
 const (
 	nextDNSDoHPrefix     = "https://dns.nextdns.io"
-	mapperIDLength       = 8
 	debugMapResponsePerm = 0o755
 )
 
@@ -50,6 +49,7 @@ type mapper struct {
 	created time.Time
 }
 
+//nolint:unused
 type patch struct {
 	timestamp time.Time
 	change    *tailcfg.PeerChange
@@ -154,6 +154,8 @@ func addNextDNSMetadata(resolvers []*dnstype.Resolver, node types.NodeView) {
 }
 
 // fullMapResponse returns a MapResponse for the given node.
+//
+//nolint:unused
 func (m *mapper) fullMapResponse(
 	nodeID types.NodeID,
 	capVer tailcfg.CapabilityVersion,

integration/helpers.go

@@ -634,6 +634,8 @@ func isSelfClient(client TailscaleClient, addr string) bool {
 // assertClientsState validates the status and netmap of a list of clients for general connectivity.
 // Runs parallel validation of status, netcheck, and netmap for all clients to ensure
 // they have proper network configuration for all-to-all connectivity tests.
+//
+//nolint:unused
 func assertClientsState(t *testing.T, clients []TailscaleClient) {
 	t.Helper()
 
@@ -661,6 +663,8 @@ func assertClientsState(t *testing.T, clients []TailscaleClient) {
 // Checks self node and all peers for essential networking data including hostinfo, addresses,
 // endpoints, and DERP configuration. Skips validation for Tailscale versions below 1.56.
 // This test is not suitable for ACL/partial connection tests.
+//
+//nolint:unused
 func assertValidNetmap(t *testing.T, client TailscaleClient) {
 	t.Helper()
 
@@ -723,6 +727,8 @@ func assertValidNetmap(t *testing.T, client TailscaleClient) {
 // assertValidStatus validates that a client's status has all required fields for proper operation.
 // Checks self and peer status for essential data including hostinfo, tailscale IPs, endpoints,
 // and network map presence. This test is not suitable for ACL/partial connection tests.
+//
+//nolint:unused
 func assertValidStatus(t *testing.T, client TailscaleClient) {
 	t.Helper()
 
@@ -781,6 +787,8 @@ func assertValidStatus(t *testing.T, client TailscaleClient) {
 // assertValidNetcheck validates that a client has a proper DERP relay configured.
 // Ensures the client has discovered and selected a DERP server for relay functionality,
 // which is essential for NAT traversal and connectivity in restricted networks.
+//
+//nolint:unused
 func assertValidNetcheck(t *testing.T, client TailscaleClient) {
 	t.Helper()
 
@@ -932,6 +940,8 @@ func usernameOwner(name string) policyv2.Owner {
 
 // groupOwner returns a Group as an Owner for use in TagOwners policies.
 // Specifies which groups can assign and manage specific tags in ACL configurations.
+//
+//nolint:unused
 func groupOwner(name string) policyv2.Owner {
 	return ptr.To(policyv2.Group(name))
 }

integration/tsic/tsic.go

@@ -52,8 +52,6 @@ var (
 	errTailscaleNotLoggedIn            = errors.New("tailscale not logged in")
 	errTailscaleWrongPeerCount         = errors.New("wrong peer count")
 	errTailscaleCannotUpWithoutAuthkey = errors.New("cannot up without authkey")
-	errTailscaleNotConnected           = errors.New("tailscale not connected")
-	errTailscaledNotReadyForLogin      = errors.New("tailscaled not ready for login")
 	errInvalidClientConfig             = errors.New("verifiably invalid client config requested")
 	errInvalidTailscaleImageFormat     = errors.New("invalid HEADSCALE_INTEGRATION_TAILSCALE_IMAGE format, expected repository:tag")
 	errTailscaleImageRequiredInCI      = errors.New("HEADSCALE_INTEGRATION_TAILSCALE_IMAGE must be set in CI for HEAD version")
@@ -1001,6 +999,8 @@ func (t *TailscaleInContainer) Netmap() (*netmap.NetworkMap, error) {
 
 // watchIPN watches `tailscale debug watch-ipn` for a ipn.Notify object until
 // it gets one that has a netmap.NetworkMap.
+//
+//nolint:unused
 func (t *TailscaleInContainer) watchIPN(ctx context.Context) (*ipn.Notify, error) {
 	pr, pw := io.Pipe()