chore(ci): suppress semgrep false positives with nosemgrep

All four findings are intentional:
- daemon_client.py: writer.write() targets a Unix socket StreamWriter,
  not a file; Django injection rule does not apply
- local_auth.py: 0o750 on /var/lib/arbor is deliberate (arbor group
  needs directory traverse; world access intentionally denied)
- daemon/main.py: 0o750 on socket dir and 0o660 on Unix socket are
  deliberate (SO_PEERCRED enforces uid allowlist on top)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gorecodes

backend/arbor/daemon_client.py

@@ -22,7 +22,7 @@ async def query(cmd: str, args: dict = None) -> AsyncIterator[dict]:
     reader, writer = await asyncio.open_unix_connection(SOCKET_PATH, limit=_READER_LIMIT)
     try:
         request = json.dumps(sign_request(cmd, request_args)) + "\n"
-        writer.write(request.encode())
+        writer.write(request.encode())  # nosemgrep: python.django.security.injection.request-data-write.request-data-write
         await writer.drain()
 
         while True:

backend/arbor/local_auth.py

@@ -99,7 +99,7 @@ def _fix_system_auth_db_permissions(path: Path) -> None:
     except OSError:
         pass
     os.chown(parent, uid, gid)
-    os.chmod(parent, 0o750)
+    os.chmod(parent, 0o750)  # nosemgrep: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
     if path.exists():
         try:
             file_stat = path.stat()

backend/daemon/main.py

@@ -3323,14 +3323,14 @@ async def main():
     socket_dir = Path(SOCKET_PATH).parent
     socket_dir.mkdir(parents=True, exist_ok=True)
     os.chown(socket_dir, 0, arbor_gid)
-    os.chmod(socket_dir, 0o750)
+    os.chmod(socket_dir, 0o750)  # nosemgrep: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
 
     if Path(SOCKET_PATH).exists():
         Path(SOCKET_PATH).unlink()
 
     server = await asyncio.start_unix_server(handle_client, path=SOCKET_PATH)
     os.chown(SOCKET_PATH, 0, arbor_gid)
-    os.chmod(SOCKET_PATH, 0o660)
+    os.chmod(SOCKET_PATH, 0o660)  # nosemgrep: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
 
     _db_init()
     _jobs.update(_load_recovered_jobs())