Fix gosec shell alias finding

[aksOps]

Summary

• Suppress the intended G204/G702 gosec findings for the shell alias preflight with an explicit justification
• Preserve existing validation: command aliases are constrained before fallback and shell-quoted before reaching the interactive shell

Root cause

The main branch Security workflow failed in Gosec static analysis because gosec reported G702 on internal/adapter/tmux_adapter.go:150. The code already documented the G204 shell execution case, but the taint analyzer now emits G702 for the same validated shell alias preflight path.

Verification

• gosec -exclude-dir=.claude -exclude-dir=vendor ./...
• skill://sonar-predictor/bin/sonar --format text check --diff
• go test -count=1 ./...
• make build
• make lint

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud