style: resolve gosec and staticcheck lint warnings

[indaco]

Description

Resolve all gosec and staticcheck warnings reported by golangci-lint:

• Suppress G702 (command injection) false positives in test files using the standard Go test re-exec pattern (os.Args[0])
• Suppress G703 (path traversal) false positives for paths from os.CreateTemp
• Suppress G115 (integer overflow uintptr -> int) for file descriptor conversions
• Replace int -> rune conversion with strconv.Itoa in formatter_test.go
• Replace WriteString(fmt.Sprintf(...)) with fmt.Fprintf(...) across 28 files (QF1012)

Related Issue

• None

Notes for Reviewers

• no behavior change - fmt.Fprintf writes directly to the builder instead of allocating an intermediate string.