fix: sanitize container log output and fix lint issues

- Update nolint comment on log streaming to accurately describe why
  gosec is suppressed (text/plain Content-Type, not HTML)
- Replace <script type="text/plain"> with data attribute for initial
  logs to prevent </script> breakout from attacker-controlled log data
- Move RemoveImage before unexported methods (funcorder)
- Fix file permissions in test (gosec G306)
- Rename unused parameters in export_test.go (revive)
- Add required blank line before assignment (wsl)

static/js/app.js

@@ -369,7 +369,7 @@ document.addEventListener("alpine:init", () => {
     init() {
       // Read initial logs from script tag (avoids escaping issues)
       const initialLogsEl = this.$el.querySelector(".initial-logs");
-      this.logs = initialLogsEl?.textContent || "Loading...";
+      this.logs = initialLogsEl?.dataset.logs || "Loading...";
 
       // Set up scroll tracking
       this.$nextTick(() => {

templates/deployments.html

@@ -98,7 +98,7 @@
                         title="Scroll to bottom"
                     >↓ Follow</button>
                 </div>
-                {{if .Logs.Valid}}<script type="text/plain" class="initial-logs">{{.Logs.String}}</script>{{end}}
+                {{if .Logs.Valid}}<div hidden class="initial-logs" data-logs="{{.Logs.String}}"></div>{{end}}
             </div>
             {{end}}
         </div>