lint: enable gosec, validate the domain open hands to the browser

[patramsey]

gosec wasn't in the enabled linter set. Turning it on surfaced 21 findings — one real (if small) weakness, and 20 false positives that now carry a written justification instead of no comment at all.

The real one

namecom open <arg> interpolated its argument straight into a URL and handed the result to open / xdg-open / rundll32:

url = "https://www.name.com/account/domain/details#?domain=" + args[0]
// ...
cmd = exec.Command("open", url)

Those parse a leading - as a flag. So namecom open -e wasn't a malformed URL — it was an argument to somebody else's program.

exec.Command doesn't invoke a shell, so there was never metacharacter injection here; argument confusion is the whole of it, which is why this is small. But open is the one command that hands user input to another binary, and namecom open "$SOME_VAR" in a script is a plausible way to reach it.

Fix: the argument is canonicalized and run through cmdutil.ValidDomainName — the same validator the other domain commands already use — before interpolation, then url.QueryEscaped. Escaping alone wouldn't have closed it: QueryEscape leaves - untouched.

URL construction moved into openTarget so the check is reachable from a test without launching a browser.

The other 20, annotated not suppressed

Rule	Sites	Why it's not a bug
G115 int→int32	4	cmdutil.ValidYears bounds --years to 1..10 a few lines above each conversion
G115 page counter	1	Bounded by LastPage, itself an int32 from the API
G304 file read	5	--file/--contacts-file exist to name a file to read; the config path is this tool's own; the update cache path comes from os.UserCacheDir()
G204 token_cmd	1	Running a shell string is the feature — see below
G101	1	A "••••••••" mask string, not a credential
G104/G115/G304/G306	~9	Test fixture plumbing

On token_cmd specifically, since "we run a shell string from a config file" deserves more than a //nolint: a helper like op read ... or pass show ... needs pipes and quoting, and cmdline comes only from the user's own config file — never a flag, an environment variable, or an API response. Anyone who can set it can already run commands as this user. The timeout and process group already there are the mitigations that actually apply.

Test-only findings are excluded by rule in .golangci.yml rather than annotated at ~9 sites, scoped to those four IDs so gosec still runs on tests for everything else.

Also: golangci-lint was truncating its own output

max-same-issues defaults to 3 per distinct message. Under the defaults this run reported 15 findings; uncapped it reports 21. The six missing ones were real call sites, dropped only because they shared wording with others — and the omission is invisible unless you already suspect it. Both caps are now disabled.

Test plan

• golangci-lint run — no issues, with gosec enabled and truncation off
• go test -race -count=1 ./... — all packages pass
• go build ./... && go vet ./... clean
• Mutation-verified: removing the ValidDomainName call from openTarget fails 5 of the 8 table cases (-foo, --version acme.io, "", ../../etc/passwd, acme.io evil.com). The tests fail for the reason claimed, not incidentally.

A CHANGELOG.md entry belongs with this, but that file arrives in #23 — I'll add the entry once that merges, or here on rebase if #23 lands first.