Satisfy the linter gate: errors.Is, context-aware exec/listen, gosec nolints

coordinator/internal/agent/setupui/server.go

@@ -107,12 +107,15 @@ func (s *PIDSupervisor) Start(configPath, logPath string) (int, error) {
 	if err != nil {
 		return 0, fmt.Errorf("resolve worker binary: %w", err)
 	}
+	//nolint:gosec // G304: logPath lives in the wizard's own config directory
 	logFile, err := os.OpenFile(logPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
 	if err != nil {
 		return 0, fmt.Errorf("open worker log: %w", err)
 	}
 	defer func() { _ = logFile.Close() }()
-	cmd := exec.Command(exe, "--config", configPath)
+	//nolint:gosec // G204: exe is os.Executable, configPath is the wizard's own file;
+	// Background ctx: the child's lifecycle is managed by the supervisor, not the context
+	cmd := exec.CommandContext(context.Background(), exe, "--config", configPath)
 	cmd.Stdout = logFile
 	cmd.Stderr = logFile
 	cmd.Stdin = nil
@@ -218,7 +221,7 @@ func New(log *slog.Logger, opts Options) *Server {
 // Listen binds the loopback listener and returns it; Serve runs the server on
 // it. Split so tests can inspect the actual ephemeral port.
 func (s *Server) Listen() (net.Listener, error) {
-	return net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", s.port))
+	return (&net.ListenConfig{}).Listen(context.Background(), "tcp", fmt.Sprintf("127.0.0.1:%d", s.port))
 }
 
 // OpenBrowser hands the wizard URL to the configured opener (default: no-op).

coordinator/internal/agent/setupui/server_test.go

@@ -80,7 +80,7 @@ func (f *fakeSup) Alive() bool {
 
 func postJSON(t *testing.T, base, path string, body any) (*httptest.ResponseRecorder, map[string]any) {
 	t.Helper()
-	req, err := http.NewRequest(http.MethodPost, base+path, strings.NewReader(mustJSON(t, body)))
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, base+path, strings.NewReader(mustJSON(t, body)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -105,7 +105,7 @@ func postJSON(t *testing.T, base, path string, body any) (*httptest.ResponseReco
 // gets a different port, so nothing can collide or share pooled connections.
 func freePort(t *testing.T) int {
 	t.Helper()
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	listener, err := (&net.ListenConfig{}).Listen(context.Background(), "tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -194,7 +194,7 @@ func TestWizardStartStopLifecycle(t *testing.T) {
 	}
 
 	// Status reflects the running state.
-	req, _ := http.NewRequest(http.MethodGet, base+"/api/status", nil)
+	req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, base+"/api/status", nil)
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatal(err)
@@ -218,7 +218,7 @@ func TestWizardStatusPrefillsSavedConfig(t *testing.T) {
 	postJSON(t, base, "/api/config", map[string]any{
 		"coordinator_url": "http://10.0.0.5:8080", "worker_key": "smk_abc", "work_dir": "/w", "worker_name": "n1",
 	})
-	req, _ := http.NewRequest(http.MethodGet, base+"/api/status", nil)
+	req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, base+"/api/status", nil)
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatal(err)