Fix Sonar findings and security hotspots

[andre-carbajal]

Summary

Implements the fixes for the 54 open issues and 2 Security Hotspots reported by Sonar on main.

Main changes

• Removes dynamic/interpolated SQL from migrations and directory-size recalculation.
• Parameterizes SQLite column inspection.
• Pins GitHub Actions to full commit SHAs and limits contents: write to the publishing job.
• Hardens the installer and platform-specific external command resolution.
• Reduces cognitive complexity in DB, scanner, watchers, TUI, configuration, and CLI code.
• Adds tests for legacy migrations, columns, nested sizes, and similar path prefixes.
• Renames the scanner interface and removes direct context storage from the TUI model.

Validation

• go test ./...
• go vet ./...
• go test -race ./internal/db ./internal/scanner ./internal/watcher
• bash -n scripts/install.sh
• Linux/macOS/Windows amd64 builds
• Sonar MCP snippet analysis reports no issues in the affected files

Closes #1