fix: Windows build + gosec lint errors (#585)

Fixes Windows build by adding platform-specific inode handling via build tags. Also fixes gosec lint warnings in migrate_tombstones.go.

Thanks @deblasis!

cmd/bd/doctor/fix/migrate_tombstones.go

@@ -42,7 +42,7 @@ func MigrateTombstones(path string) error {
 
 	// Load existing JSONL to check for already-existing tombstones
 	existingTombstones := make(map[string]bool)
-	if file, err := os.Open(jsonlPath); err == nil {
+	if file, err := os.Open(filepath.Clean(jsonlPath)); err == nil {
 		scanner := bufio.NewScanner(file)
 		scanner.Buffer(make([]byte, 0, 64*1024), 10*1024*1024)
 		for scanner.Scan() {
@@ -56,7 +56,7 @@ func MigrateTombstones(path string) error {
 				}
 			}
 		}
-		file.Close()
+		_ = file.Close()
 	}
 
 	// Convert deletions to tombstones
@@ -74,7 +74,7 @@ func MigrateTombstones(path string) error {
 		fmt.Printf("  All %d deletion(s) already have tombstones - archiving deletions.jsonl\n", skipped)
 	} else {
 		// Append tombstones to issues.jsonl
-		file, err := os.OpenFile(jsonlPath, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0644)
+		file, err := os.OpenFile(filepath.Clean(jsonlPath), os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0600)
 		if err != nil {
 			return fmt.Errorf("failed to open issues.jsonl: %w", err)
 		}

internal/storage/sqlite/freshness.go

@@ -4,7 +4,6 @@ package sqlite
 import (
 	"os"
 	"sync"
-	"syscall"
 	"time"
 )
 
@@ -49,12 +48,8 @@ func (fc *FreshnessChecker) captureFileState() {
 	fc.lastMtime = info.ModTime()
 	fc.lastSize = info.Size()
 
-	// Get inode on Unix systems
-	if sys := info.Sys(); sys != nil {
-		if stat, ok := sys.(*syscall.Stat_t); ok {
-			fc.lastInode = stat.Ino
-		}
-	}
+	// Get inode (Unix only, returns 0 on Windows)
+	fc.lastInode = getFileInode(info)
 }
 
 // Check examines the database file for changes and triggers reconnection if needed.
@@ -75,12 +70,7 @@ func (fc *FreshnessChecker) Check() bool {
 	}
 
 	// Check if file was replaced by comparing inode
-	var currentInode uint64
-	if sys := info.Sys(); sys != nil {
-		if stat, ok := sys.(*syscall.Stat_t); ok {
-			currentInode = stat.Ino
-		}
-	}
+	currentInode := getFileInode(info)
 
 	// Detect file replacement:
 	// 1. Inode changed (file was replaced, most reliable on Unix)

internal/storage/sqlite/freshness_unix.go

@@ -0,0 +1,19 @@
+//go:build !windows
+
+// Package sqlite implements the storage interface using SQLite.
+package sqlite
+
+import (
+	"os"
+	"syscall"
+)
+
+// getFileInode extracts the inode from file info on Unix systems.
+func getFileInode(info os.FileInfo) uint64 {
+	if sys := info.Sys(); sys != nil {
+		if stat, ok := sys.(*syscall.Stat_t); ok {
+			return stat.Ino
+		}
+	}
+	return 0
+}

internal/storage/sqlite/freshness_windows.go

@@ -0,0 +1,16 @@
+//go:build windows
+
+// Package sqlite implements the storage interface using SQLite.
+package sqlite
+
+import (
+	"os"
+)
+
+// getFileInode returns 0 on Windows since inodes are not available.
+// File replacement detection will rely on mtime/size instead.
+func getFileInode(info os.FileInfo) uint64 {
+	// Windows doesn't have inodes, return 0 to skip inode-based detection.
+	// The FreshnessChecker will fall back to mtime-based detection.
+	return 0
+}