fix: Windows build + gosec lint errors (#585)

Fixes Windows build by adding platform-specific inode handling via build tags. Also fixes gosec lint warnings in migrate_tombstones.go.

Thanks @deblasis!

internal/storage/sqlite/freshness_windows.go

@@ -0,0 +1,16 @@
+//go:build windows
+
+// Package sqlite implements the storage interface using SQLite.
+package sqlite
+
+import (
+	"os"
+)
+
+// getFileInode returns 0 on Windows since inodes are not available.
+// File replacement detection will rely on mtime/size instead.
+func getFileInode(info os.FileInfo) uint64 {
+	// Windows doesn't have inodes, return 0 to skip inode-based detection.
+	// The FreshnessChecker will fall back to mtime-based detection.
+	return 0
+}