Split gocognit complexity fixes (#2327) into per-subsystem PRs #2377

Tracking issue for splitting up #2327 (enable the gocognit linter) into reviewable, per-subsystem PRs.

Background

#2327 enables gocognit (min-complexity 15) across every Go module and fixes every violation it found. The diff ended up touching 100+ files across most subsystems in one PR, which made it hard to review closely, and a real regression (a dropped signature-signing call in a mechanical extraction) got through review as a result and only showed up in the itest matrix, not in unit tests or lint.

Per @adecaro and @Effi-S's feedback on #2327, this work is being split: #2327 becomes the base PR (enables the linter repo-wide, keeps the small number of permanent, security/crypto-justified //nolint:gocognit waivers), and every function that needs an actual complexity-reducing extraction gets a temporary //nolint:gocognit // TODO(#2377): tracked in issue #N marker instead, removed one subsystem at a time by the sub-PRs below.

Sub-issues

• gocognit split: token/core/common #2378 token/core/common
• gocognit split: token/core/fabtoken #2379 token/core/fabtoken
• gocognit split: token/core/zkatdlog #2380 token/core/zkatdlog
• gocognit split: token/services/identity #2381 token/services/identity
• gocognit split: token/services/ttx #2382 token/services/ttx
• gocognit split: token/services/selector #2383 token/services/selector
• gocognit split: token/services/storage #2384 token/services/storage
• gocognit split: token/services/network #2385 token/services/network
• gocognit split: token/services/benchmark #2386 token/services/benchmark
• gocognit split: token/services misc (tokens, auditor, certifier, interop/htlc, driver) #2387 token/services misc (tokens, auditor, certifier, interop/htlc, driver)
• gocognit split: integration module #2388 integration module
• gocognit split: cmd/* tooling modules #2389 cmd/* tooling modules

Each sub-issue lists the exact files in scope.