fix: resolve three targeted lint-monster diagnostics (defer-in-loop, excess params, hardcoded path)

[Copilot]

Three custom-lint findings from the 2026-07-26 scan: defer inside a loop, a 9-parameter function exceeding the 8-param limit, and a hardcoded /tmp path.

Changes

• mcp_inspect_inspector.go — Move timer.Stop() out of defer into direct call after each select, so timers are released per iteration rather than piling up until function return.

• docker_images.go — Replace the 8 bool parameters on CheckAndPrepareDockerImages with a DockerImagesOptions struct:

  // Before
  func CheckAndPrepareDockerImages(ctx context.Context,
      useZizmor, usePoutine, useActionlint, useRunnerGuard,
      useSyft, useGrype, useGrant, useYamllint bool) error
  
  // After
  type DockerImagesOptions struct {
      Zizmor, Poutine, Actionlint, RunnerGuard, Syft, Grype, Grant, Yamllint bool
  }
  func CheckAndPrepareDockerImages(ctx context.Context, opts DockerImagesOptions) error

  Caller in mcp_tools_readonly.go and all tests updated accordingly.

• grant.go — Extract the literal "/tmp/gh-aw-grant-policy.yaml" to a named constant grantContainerPolicyPath; no behavior change.

• Fixes [lint-monster] Targeted custom-lint cleanup: resource lifecycle and API shape (2026-07-26) #48113

[github-actions]

Great work on the targeted cleanup! 🚀

This PR looks excellent — it systematically addresses three specific lint-monster diagnostics while maintaining focus and including proper test updates:

• defer-in-loop fix in mcp_inspect_inspector.go — timer.Stop() moved out of defer for correct resource release per iteration
• Parameter refactoring in docker_images.go — 8 individual bool parameters replaced with a clean DockerImagesOptions struct, well-structured and easier to maintain
• Hardcoded path extraction in grant.go — /tmp/gh-aw-grant-policy.yaml now a named constant for clarity and maintainability

The diff is focused, tests are updated, and the description is clear. This is ready for review!

Generated by ✅ Contribution Check · sonnet50 · 50.8 AIC · ⌖ 10.4 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

• Category: refactor | Risk: low | Score: 33/100
• Impact 15 · Urgency 8 · Quality 10
• Recommended action: defer

Targeted lint-monster diagnostic fixes (defer-in-loop, param count, hardcoded path). Draft status, no CI yet. Low urgency, batchable with other lint-monster PRs.

Generated by 🔧 PR Triage Agent · sonnet50 · 50.9 AIC · ⌖ 5.23 AIC · ⊞ 7.5K · ◷