fix: triage and resolve the remaining Sonar findings

[Castrozan]

The dotfiles Sonar backlog still needs triage and remediation after the completed quick-fix batch. Validate findings against runtime behavior, fix confirmed defects, and record evidence for false positives or rule-policy decisions.

Snapshot from the Sonar report, analysis dated 2026-09-15T03:33:20+0000 at the analyzed revision: 852 open findings, classified by Sonar as 680 code smells, 160 vulnerabilities, and 12 bugs. These are analyzer classifications; security findings still require validation. The quality gate passes because it evaluates new code, so it does not establish that the existing backlog is resolved.

Work group	Open findings	Required investigation
Agent input handling	50	Trace path injection, argument injection, command injection, and SSRF warnings through actual trust boundaries.
Filesystem handling	28	Validate temporary-file handling and path confinement.
Cloud permissions and downloaded installers	4	Review three IAM permission findings and one installer executed without verification.
Cognitive complexity	38	Refactor functions exceeding their configured complexity limit while preserving behavior.
Exception-test ambiguity	29	Ensure each exception assertion identifies the operation expected to fail, preserving async and cleanup coverage.
Three largest shell convention rules	385	Review bracket style, variable names, and explicit returns against the actual Bash or POSIX contract.
Remaining rules	318	Use the live inventory for the remaining correctness, security, duplication, and language-specific findings.

Use the live Sonar inventory when starting each batch; these counts identify the starting scope. Prioritize security and correctness findings before mechanical style changes. Coordinate file-size and directory refactors with the existing structural-limits issue.

The completed batch already closed 20 redundant Python exception findings and five GitHub Action pin findings, and resolved one confirmed sudoers credential false positive. Keep those fixes and the current enforcement intact.

Acceptance criteria:

• Triage every open finding with its rule, affected scope, evidence, and proposed fix or justified disposition.
• Confirmed security and correctness defects have focused reproducers and regression coverage.
• Refactors preserve runtime behavior; shell changes respect each script's Bash or POSIX requirements.
• Resolve the backlog through fixes or evidence-backed dispositions without blanket suppression, broader exclusions, or weakened limits and gates.
• Each batch passes focused checks, rebuild, CI, and Sonar analysis of the pushed revision; record before-and-after counts.