fix: Windows build + gosec lint errors (#585)

Fixes Windows build by adding platform-specific inode handling via build tags. Also fixes gosec lint warnings in migrate_tombstones.go.

Thanks @deblasis!

internal/storage/sqlite/freshness.go

@@ -4,7 +4,6 @@ package sqlite
 import (
 	"os"
 	"sync"
-	"syscall"
 	"time"
 )
 
@@ -49,12 +48,8 @@ func (fc *FreshnessChecker) captureFileState() {
 	fc.lastMtime = info.ModTime()
 	fc.lastSize = info.Size()
 
-	// Get inode on Unix systems
-	if sys := info.Sys(); sys != nil {
-		if stat, ok := sys.(*syscall.Stat_t); ok {
-			fc.lastInode = stat.Ino
-		}
-	}
+	// Get inode (Unix only, returns 0 on Windows)
+	fc.lastInode = getFileInode(info)
 }
 
 // Check examines the database file for changes and triggers reconnection if needed.
@@ -75,12 +70,7 @@ func (fc *FreshnessChecker) Check() bool {
 	}
 
 	// Check if file was replaced by comparing inode
-	var currentInode uint64
-	if sys := info.Sys(); sys != nil {
-		if stat, ok := sys.(*syscall.Stat_t); ok {
-			currentInode = stat.Ino
-		}
-	}
+	currentInode := getFileInode(info)
 
 	// Detect file replacement:
 	// 1. Inode changed (file was replaced, most reliable on Unix)

internal/storage/sqlite/freshness_unix.go

@@ -0,0 +1,19 @@
+//go:build !windows
+
+// Package sqlite implements the storage interface using SQLite.
+package sqlite
+
+import (
+	"os"
+	"syscall"
+)
+
+// getFileInode extracts the inode from file info on Unix systems.
+func getFileInode(info os.FileInfo) uint64 {
+	if sys := info.Sys(); sys != nil {
+		if stat, ok := sys.(*syscall.Stat_t); ok {
+			return stat.Ino
+		}
+	}
+	return 0
+}

internal/storage/sqlite/freshness_windows.go

@@ -0,0 +1,16 @@
+//go:build windows
+
+// Package sqlite implements the storage interface using SQLite.
+package sqlite
+
+import (
+	"os"
+)
+
+// getFileInode returns 0 on Windows since inodes are not available.
+// File replacement detection will rely on mtime/size instead.
+func getFileInode(info os.FileInfo) uint64 {
+	// Windows doesn't have inodes, return 0 to skip inode-based detection.
+	// The FreshnessChecker will fall back to mtime-based detection.
+	return 0
+}