fix: remaining gosec nolint, flaky quit test, spctl after notarize

- Add nolint:gosec for path traversal false positives in sync.go
- Fix flaky TestServer_QuitCommand with assert.Eventually
- Move Gatekeeper spctl check after notarization+staple in release workflow

Author: Romancha

.github/workflows/release-bridge.yml

@@ -179,10 +179,6 @@ jobs:
             --timestamp \
             "$DMG_NAME"
 
-      - name: Verify Gatekeeper acceptance
-        run: |
-          spctl --assess --type execute --verbose=2 bin/SalmonRun.app
-
       - name: Notarize .dmg
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
@@ -199,6 +195,10 @@ jobs:
         run: |
           xcrun stapler staple "$DMG_NAME"
 
+      - name: Verify Gatekeeper acceptance
+        run: |
+          spctl --assess --type execute --verbose=2 bin/SalmonRun.app
+
       - name: Verify signatures
         run: |
           echo "Verifying .dmg signature..."

cmd/bridge/sync.go

@@ -123,13 +123,13 @@ func (b *Bridge) bearDBModTime() int64 {
 
 	var maxNano int64
 
-	if info, err := os.Stat(dbPath); err == nil {
+	if info, err := os.Stat(dbPath); err == nil { //nolint:gosec // G703: path built from cleaned bearDataDir
 		if t := info.ModTime().UnixNano(); t > maxNano {
 			maxNano = t
 		}
 	}
 
-	if info, err := os.Stat(walPath); err == nil {
+	if info, err := os.Stat(walPath); err == nil { //nolint:gosec // G703: path built from cleaned bearDataDir
 		if t := info.ModTime().UnixNano(); t > maxNano {
 			maxNano = t
 		}
@@ -689,7 +689,7 @@ func (b *Bridge) resolveAttachmentFilePath(attType, bearID, filename string) str
 
 	if filename != "" {
 		candidate := filepath.Join(dir, filename)
-		if _, err := os.Stat(candidate); err == nil {
+		if _, err := os.Stat(candidate); err == nil { //nolint:gosec // G703: path built from cleaned bearDataDir
 			return candidate
 		}
 	}

internal/ipc/server_test.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -204,9 +205,11 @@ func TestServer_QuitCommand(t *testing.T) {
 	require.NoError(t, json.Unmarshal(resp, &ok))
 	assert.True(t, ok.Ok)
 
-	provider.mu.Lock()
-	assert.True(t, provider.shutdownCalled)
-	provider.mu.Unlock()
+	assert.Eventually(t, func() bool {
+		provider.mu.Lock()
+		defer provider.mu.Unlock()
+		return provider.shutdownCalled
+	}, time.Second, 10*time.Millisecond)
 }
 
 func TestServer_UnknownCommand(t *testing.T) {