style: suppress gosec G703/G704 taint false positives with justification

The v2.12.2 gosec ruleset's new path-traversal (G703) and SSRF (G704)
taint checks flag os.Stat/os.Remove/os.Rename calls on paths that are
never attacker-controlled: our own temp files created immediately
before in the same function, content-hash- or cache-key-derived
storage paths, the operator-supplied config search path, and the
already SSRF-guarded upstream fetch (protected by ssrfSafeDialer at
the transport layer). Each suppression carries the rule ID and a
one-line justification, matching this repo's existing gosec nolint
convention in internal/imgcache/storage.go. No behavior change.

internal/imgcache/storage.go

@@ -94,22 +94,23 @@ func (s *ContentStorage) Store(r io.Reader) (ContentHash, int64, error) {
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return "", 0, fmt.Errorf("failed to write content: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return "", 0, fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename
+	//nolint:gosec // G703: tmp file is ours, path is derived from content hash
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return "", 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}
@@ -253,22 +254,23 @@ func (s *MetadataStorage) Store(
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return fmt.Errorf("failed to write metadata: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename
+	//nolint:gosec // G703: tmp file is ours, path is derived from cache key
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return fmt.Errorf("failed to rename temp file: %w", err)
 	}
@@ -410,22 +412,23 @@ func (s *VariantStorage) Store(
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return 0, fmt.Errorf("failed to write content: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return 0, fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename content
+	//nolint:gosec // G703: tmp file is ours, path is derived from cache key
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath)
+		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
 
 		return 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}