Defer file closes in pkg/cli workflow readers and logs cache writer

[Copilot]

LintMonster flagged three os.Open/os.OpenFile call sites in pkg/cli where Close() was not deferred immediately after a successful open, leaving room for descriptor leaks on early returns.

• Workflow file readers

  • Updated filterMarkdownFilesWithFrontmatter to read each file inside a narrow helper scope and defer fd.Close() immediately after os.Open.
  • Updated extractWorkflowNameFromFile to use a deferred close while preserving the existing close-error propagation.

• MCP logs cache writer

  • Updated buildLogsFileResponse to write through a small scoped helper that defers f.Close() immediately after os.OpenFile.
  • Kept the existing distinction between open failures and write/close failures so cache-file cleanup and returned errors stay aligned with current behavior.

• Error handling shape

  • Switched the touched paths to named-return/deferred-close handling where needed so close errors are still surfaced without relying on manual non-deferred Close() calls.

Example pattern applied:

f, err := os.Open(path)
if err != nil {
	return err
}
defer func() {
	if closeErr := f.Close(); closeErr != nil && err == nil {
		err = closeErr
	}
}()

// ... use f ...