refactor: harden diagnostics and consolidate runtime code

audit/internal/app/blackbox_archive.go

@@ -3,6 +3,7 @@ package app
 import (
 	"archive/zip"
 	"bufio"
+	"errors"
 	"io"
 	"io/fs"
 	"os"
@@ -61,9 +62,8 @@ func buildZipArchive(root, destPath string) error {
 		if err != nil {
 			return err
 		}
-		defer src.Close()
-		_, err = io.Copy(w, src)
-		return err
+		_, copyErr := io.Copy(w, src)
+		return errors.Join(copyErr, src.Close())
 	})
 	if walkErr != nil {
 		_ = zw.Close()
@@ -136,7 +136,7 @@ func isEOFLike(err error) bool {
 // (first run, external tampering, a previous crash mid-write), it falls back
 // to writing the whole archive rather than risk corrupting it with a wrong
 // truncate point.
-func patchArchiveOnTarget(targetPath, newLocalZipPath, cachedPath string) error {
+func patchArchiveOnTarget(targetPath, newLocalZipPath, cachedPath string) (retErr error) {
 	newInfo, err := os.Stat(newLocalZipPath)
 	if err != nil {
 		return err
@@ -159,7 +159,7 @@ func patchArchiveOnTarget(targetPath, newLocalZipPath, cachedPath string) error
 	if err != nil {
 		return err
 	}
-	defer target.Close()
+	defer func() { retErr = errors.Join(retErr, target.Close()) }()
 
 	if err := target.Truncate(prefixLen); err != nil {
 		return err
@@ -172,7 +172,7 @@ func patchArchiveOnTarget(targetPath, newLocalZipPath, cachedPath string) error
 	if err != nil {
 		return err
 	}
-	defer src.Close()
+	defer func() { retErr = errors.Join(retErr, src.Close()) }()
 	if _, err := src.Seek(prefixLen, io.SeekStart); err != nil {
 		return err
 	}