chore(agentcompat): document intentional scanner findings

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/cmd/agentcompat/metadata_writer.go

@@ -27,7 +27,7 @@ func writeMetadata(ctx context.Context, config cliConfig, now time.Time) error {
 	if err := os.MkdirAll(resultsDir, 0o700); err != nil {
 		return fmt.Errorf("create results directory: %w", err)
 	}
-	if err := os.Chmod(resultsDir, 0o700); err != nil {
+	if err := os.Chmod(resultsDir, 0o700); err != nil { // #nosec G302 -- 0700 is the required private directory mode; artifacts are written 0600.
 		return fmt.Errorf("secure results directory: %w", err)
 	}
 	if err := prepareResultsDir(resultsDir); err != nil {

integration/agentcompat/internal/workflowpolicy/types.go

@@ -25,7 +25,7 @@ const (
 	RuleRepositoryNotAllowed   Rule = "repository-not-allowed"
 	RuleRepositoryNotLiteral   Rule = "repository-not-literal"
 	RuleOtherRepositoryRef     Rule = "other-repository-ref"
-	RulePersistCredentials     Rule = "persist-credentials"
+	RulePersistCredentials     Rule = "persist-credentials" // #nosec G101 -- GitHub Actions configuration key, not a credential.
 	RuleReusableExecutable     Rule = "reusable-executable"
 	RuleContinueOnError        Rule = "continue-on-error"
 	RuleSwallowedFailure       Rule = "swallowed-failure"