chore: suppress false-positive gosec G118/G602/G703 from updated linter

The flake update pulled a newer golangci-lint with new gosec rules:
- G118: cancel stored in struct field, called later (not leaked)
- G602: specs and natural slices have equal length by construction
- G703: WriteFile paths are tmpDir + constant filename, not tainted

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

internal/app/chat_test.go

@@ -120,7 +120,9 @@ func TestCancellationDuringSQLGeneration(t *testing.T) {
 	m := newTestModel(t)
 	m.openChat()
 
-	_, cancel := context.WithCancel(context.Background())
+	_, cancel := context.WithCancel(
+		context.Background(),
+	) //nolint:gosec // cancel stored in CancelFn, called by ctrl+c
 	m.chat.CurrentQuery = testQuestion
 	m.chat.Streaming = true
 	m.chat.StreamingSQL = true
@@ -150,7 +152,9 @@ func TestCancellationDuringAnswerStreaming(t *testing.T) {
 	m := newTestModel(t)
 	m.openChat()
 
-	_, cancel := context.WithCancel(context.Background())
+	_, cancel := context.WithCancel(
+		context.Background(),
+	) //nolint:gosec // cancel stored in CancelFn, called by ctrl+c
 	m.chat.CurrentQuery = testQuestion
 	m.chat.Streaming = true
 	m.chat.StreamingSQL = false // stage 2

internal/app/extraction.go

@@ -935,7 +935,9 @@ func (m *Model) rerunLLMExtraction() tea.Cmd {
 
 	// Replace a cancelled context so the rerun has a live one.
 	if ex.ctx.Err() != nil {
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(
+			context.Background(),
+		) //nolint:gosec // cancel stored in ex.CancelFn, called on extraction close
 		ex.ctx = ctx
 		ex.CancelFn = cancel
 	}

internal/app/table.go

@@ -879,8 +879,9 @@ func columnWidths(
 	// Content exceeds terminal width — apply Max constraints.
 	widths := make([]int, columnCount)
 	for i, w := range natural {
-		if specs[i].Max > 0 && w > specs[i].Max {
-			w = specs[i].Max
+		if specs[i].Max > 0 &&
+			w > specs[i].Max { //nolint:gosec // specs and natural have equal length (columnCount)
+			w = specs[i].Max //nolint:gosec // same bounds
 		}
 		widths[i] = w
 	}

internal/extract/ocr.go

@@ -38,7 +38,7 @@ func ocrPDF(ctx context.Context, data []byte, maxPages int) (string, []byte, err
 	defer os.RemoveAll(tmpDir) //nolint:errcheck // best-effort cleanup
 
 	pdfPath := filepath.Join(tmpDir, "input.pdf")
-	if err := os.WriteFile(pdfPath, data, 0o600); err != nil {
+	if err := os.WriteFile(pdfPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		return "", nil, fmt.Errorf("write temp pdf: %w", err)
 	}
 
@@ -271,7 +271,7 @@ func ocrImage(ctx context.Context, data []byte) (string, []byte, error) {
 	defer os.RemoveAll(tmpDir) //nolint:errcheck // best-effort cleanup
 
 	imgPath := filepath.Join(tmpDir, "input")
-	if err := os.WriteFile(imgPath, data, 0o600); err != nil {
+	if err := os.WriteFile(imgPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		return "", nil, fmt.Errorf("write temp image: %w", err)
 	}
 

internal/extract/ocr_progress.go

@@ -73,7 +73,7 @@ func ocrImageWithProgress(ctx context.Context, data []byte, ch chan<- ExtractPro
 	defer os.RemoveAll(tmpDir) //nolint:errcheck // best-effort cleanup
 
 	imgPath := filepath.Join(tmpDir, "input.png")
-	if err := os.WriteFile(imgPath, data, 0o600); err != nil {
+	if err := os.WriteFile(imgPath, data, 0o600); err != nil { //nolint:gosec // path is tmpDir + constant filename
 		ch <- ExtractProgress{Err: fmt.Errorf("write temp image: %w", err), Done: true}
 		return
 	}