chore: fix all gosec G118/G602/G703 findings from updated linter

- G118: add t.Cleanup(cancel) to all test context.WithCancel calls so
  the cancel function is always invoked at test end
- G602: nolint on table.go slice access where specs and natural have
  equal length by construction
- G703: nolint on WriteFile calls where path is tmpDir + constant
  filename (no tainted components)
- Keep nolint on extraction.go production code where cancel is stored
  in struct field and called on extraction close

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

internal/app/chat_test.go

@@ -244,6 +244,7 @@ func TestNoSpinnerAfterCancellation(t *testing.T) {
 	m.openChat()
 
 	_, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.chat.Streaming = true
 	m.chat.StreamingSQL = true
 	m.chat.CancelFn = cancel
@@ -278,6 +279,7 @@ func TestLateSQLChunkAfterCancellationIsDropped(t *testing.T) {
 	m.openChat()
 
 	_, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.chat.Streaming = true
 	m.chat.StreamingSQL = true
 	m.chat.CancelFn = cancel
@@ -314,6 +316,7 @@ func TestLateChatChunkAfterCancellationIsDropped(t *testing.T) {
 	m.openChat()
 
 	_, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.chat.Streaming = true
 	m.chat.CancelFn = cancel
 	m.chat.Messages = []chatMessage{

internal/app/extraction_test.go

@@ -26,6 +26,7 @@ func newExtractionModel(t *testing.T, steps map[extractionStep]stepStatus) *Mode
 
 	m := newTestModel(t)
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
 		ctx:        ctx,
@@ -913,6 +914,7 @@ func TestForeground_SwapsCurrentToBackground(t *testing.T) {
 
 	// Create a new foreground extraction.
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.ex.extraction = &extractionLogState{
 		ID:         nextExtractionID.Add(1),
 		Filename:   "second.pdf",
@@ -1051,6 +1053,7 @@ func TestMultipleBgExtractions(t *testing.T) {
 
 	// Create and background second.
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.ex.extraction = &extractionLogState{
 		ID:         nextExtractionID.Add(1),
 		Filename:   "b.pdf",
@@ -1088,6 +1091,7 @@ func TestStartExtraction_AutoBackgroundsExisting(t *testing.T) {
 	// This tests the backgrounding logic directly.
 	m.backgroundExtraction()
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.ex.extraction = &extractionLogState{
 		ID:         nextExtractionID.Add(1),
 		Filename:   "new.pdf",
@@ -1134,6 +1138,7 @@ func TestCtrlQ_CancelsAllBgExtractions(t *testing.T) {
 
 	// Create another foreground extraction.
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	m.ex.extraction = &extractionLogState{
 		ID:         nextExtractionID.Add(1),
 		Filename:   "fg2.pdf",
@@ -1817,6 +1822,7 @@ func TestDispatch_VendorCrossReference(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
@@ -1885,6 +1891,7 @@ func TestDispatch_InvalidProjectIDShowsError(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
@@ -1950,6 +1957,7 @@ func TestDispatch_OffsetCrossReference(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
@@ -2032,6 +2040,7 @@ func TestDispatch_DuplicateVendorDedup(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
@@ -2102,6 +2111,7 @@ func TestDispatch_DuplicateApplianceDedup(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),
@@ -2163,6 +2173,7 @@ func TestDispatch_TransactionRollbackOnFailure(t *testing.T) {
 	require.NoError(t, sdb.Stage(ops))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
 	defer cancel()
 	ex := &extractionLogState{
 		ID:         nextExtractionID.Add(1),

internal/app/table.go

@@ -879,8 +879,8 @@ func columnWidths(
 	// Content exceeds terminal width — apply Max constraints.
 	widths := make([]int, columnCount)
 	for i, w := range natural {
-		if specs[i].Max > 0 &&
-			w > specs[i].Max { //nolint:gosec // specs and natural have equal length (columnCount)
+		if specs[i].Max > 0 && //nolint:gosec // specs and natural have equal length (columnCount)
+			w > specs[i].Max { //nolint:gosec // same bounds
 			w = specs[i].Max //nolint:gosec // same bounds
 		}
 		widths[i] = w

internal/extract/ocr_bench_test.go

@@ -44,7 +44,7 @@ func BenchmarkOcrPage(b *testing.B) {
 
 	tmpDir := b.TempDir()
 	pdfPath := filepath.Join(tmpDir, "input.pdf")
-	if err := os.WriteFile(pdfPath, data, 0o600); err != nil {
+	if err := os.WriteFile(pdfPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		b.Fatal(err)
 	}
 

internal/extract/ocr_progress.go

@@ -118,7 +118,7 @@ func ocrPDFWithProgress(
 	defer os.RemoveAll(tmpDir) //nolint:errcheck // best-effort cleanup
 
 	pdfPath := filepath.Join(tmpDir, "input.pdf")
-	if err := os.WriteFile(pdfPath, data, 0o600); err != nil {
+	if err := os.WriteFile(pdfPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		ch <- ExtractProgress{Err: fmt.Errorf("write temp pdf: %w", err), Done: true}
 		return
 	}

internal/extract/text.go

@@ -59,7 +59,7 @@ func extractPDF(ctx context.Context, data []byte) (string, error) {
 	defer os.RemoveAll(tmpDir) //nolint:errcheck // best-effort cleanup
 
 	pdfPath := filepath.Join(tmpDir, "input.pdf")
-	if err := os.WriteFile(pdfPath, data, 0o600); err != nil {
+	if err := os.WriteFile(pdfPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		return "", fmt.Errorf("write temp pdf: %w", err)
 	}