fix: suppress gosec false positives in Linux server support

- G204 in proc_spawner_nix.go and proc_spawner_win.go: exePath is the
  server's own validated binary path, not arbitrary user input
- G302 in updater.go: 0o755 is required for the extracted Linux binary
  to be executable

Server/updater/proc_spawner_nix.go

@@ -10,7 +10,7 @@ import (
 
 // SpawnDetached starts a new process that is not attached to the current one.
 func SpawnDetached(exePath string, args []string) error {
-	cmd := exec.Command(exePath, args...)
+	cmd := exec.Command(exePath, args...) //nolint:gosec // G204: exePath is the server's own binary path, validated by the caller
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	cmd.SysProcAttr = &syscall.SysProcAttr{

Server/updater/proc_spawner_win.go

@@ -10,7 +10,7 @@ import (
 
 // SpawnDetached starts a new process that is not attached to the current one.
 func SpawnDetached(exePath string, args []string) error {
-	cmd := exec.Command(exePath, args...)
+	cmd := exec.Command(exePath, args...) //nolint:gosec // G204: exePath is the server's own binary path, validated by the caller
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 

Server/updater/updater.go

@@ -299,7 +299,7 @@ func (u *Updater) downloadLinuxTarballAndVerify(ctx context.Context, downloadURL
 		_ = os.Remove(destPath)
 		return fmt.Errorf("extracting archive: %w", err)
 	}
-	if err := os.Chmod(destPath, 0o755); err != nil {
+	if err := os.Chmod(destPath, 0o755); err != nil { //nolint:gosec // G302: binary must be world-executable to run
 		return fmt.Errorf("chmod binary: %w", err)
 	}
 	return nil