style: suppress gosec G703/G704 taint false positives with justification

The v2.12.2 gosec ruleset's new path-traversal (G703) and SSRF (G704)
taint checks flag os.Stat/os.Remove/os.Rename calls on paths that are
never attacker-controlled: our own temp files created immediately
before in the same function, content-hash- or cache-key-derived
storage paths, the operator-supplied config search path, and the
already SSRF-guarded upstream fetch (protected by ssrfSafeDialer at
the transport layer). Each suppression carries the rule ID and a
one-line justification, matching this repo's existing gosec nolint
convention in internal/imgcache/storage.go. No behavior change.

internal/config/config.go

@@ -299,7 +299,7 @@ func (c *Config) ensureStateDirWritable() error {
 			keyStateDir, probePath, err)
 	}
 
-	err = os.Remove(probePath)
+	err = os.Remove(probePath) //nolint:gosec // G703: our own probe file, not user input
 	if err != nil {
 		return fmt.Errorf("config key %q: cannot remove probe file %q: %w",
 			keyStateDir, probePath, err)
@@ -411,6 +411,7 @@ func loadConfigFile(log *slog.Logger, appName string) (*smartconfig.Config, erro
 	for _, path := range configPaths {
 		cleanPath := filepath.Clean(path)
 
+		//nolint:gosec // G703: config path is operator-supplied by design
 		_, statErr := os.Stat(cleanPath)
 		if statErr == nil {
 			// A config file that exists but does not parse is a fatal