fix(api): potential softlocks on unreleased R challenge locks

[pandatix]

This PR adds missing clock.Runlock calls. Current implementation can lead to softlocks, such that only read operations on challenges are possible in the future. In case of local lock a reboot is sufficient to fix, yet as it is stateful it is nearly impossible in production ; etcd needs Ops deleting the locks manually, which suffers from the previous plus the complexity of etcd itself.

It also fixes the linting errors that appeared a while ago through a silent update in golangci-lint, blocking again the dependabot PRs.

Found by @d3vyce

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / buf-lint (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Oct 8, 2026, 1:52 PM

[coveralls]

Coverage Report for CI Build 37787800131

Warning

No base build found for commit 16d206c on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 37.589%

Details

• Patch coverage: 35 uncovered changes across 5 files (0 of 35 lines covered, 0.0%).

Uncovered Changes

File	Changed	Covered	%
api/v1/instance/delete.go	18	0	0.0%
api/v1/instance/create.go	11	0	0.0%
api/v1/challenge/query.go	2	0	0.0%
api/v1/challenge/retrieve.go	2	0	0.0%
api/v1/challenge/update.go	2	0	0.0%

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	9689
Covered Lines:	3642
Line Coverage:	37.59%
Coverage Strength:	0.41 hits per line

---

💛 - Coveralls

[d3vyce]

Tested, it fixes the softlock 👌