feat: implement issue #1361 — SonarCloud: code security review (pythonsecurity)
DO
1h ago+93+93+01234567890123456789-11-11-01234567890123456789
Problem
SonarCloud: code security review (pythonsecurity)
From the issue: 2 open SonarCloud finding(s) in combsmith/.github, worst severity MAJOR. Generated by the org SonarCloud Audit.
Risk
Low — 3 file(s) changed; no CI- or runtime-critical paths touched.
Test plan
No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.
Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
This PR's CI checks (Lint + bats) are the success/regression signal.
Closes #1361