chore: strengthen backend eslint profile

test/sqlite-regression.cjs

@@ -12,7 +12,9 @@ const { join, resolve } = require('node:path');
 const cwd = resolve(__dirname, '..');
 const evidence = mkdtempSync(join(tmpdir(), 'wealthledger-sqlite-regression-'));
 const sentinel = join(evidence, 'user.db');
+// eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
 writeFileSync(sentinel, 'fictional user database: must never be opened');
+// eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
 const before = readFileSync(sentinel);
 const databases = new Set();
 async function check(name, overrides = {}, signal) {
@@ -43,6 +45,7 @@ async function check(name, overrides = {}, signal) {
     child.once('error', reject);
     child.once('close', resolve);
   });
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
   writeFileSync(join(evidence, `${name}.log`), log);
   const dirs = [...log.matchAll(/^SQLite .+: (.+)$/gm)].map(
     (match) => match[1],
@@ -51,21 +54,23 @@ async function check(name, overrides = {}, signal) {
   for (const dir of dirs) {
     assert.ok(!databases.has(dir), 'runners must never share databases');
     databases.add(dir);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
     assert.ok(!existsSync(dir), `runner must clean up ${dir}`);
   }
   assert.deepEqual(
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
     readFileSync(sentinel),
     before,
     'user database must be untouched',
   );
   const expected =
-    signal === 'SIGINT'
-      ? 130
-      : signal === 'SIGTERM'
-        ? 143
-        : overrides.PRISMA_SCHEMA_ENGINE_BINARY
-          ? 1
-          : 0;
+    signal === 'SIGINT' ?
+      130 :
+      signal === 'SIGTERM' ?
+        143 :
+        overrides.PRISMA_SCHEMA_ENGINE_BINARY ?
+          1 :
+          0;
   assert.equal(code, expected, `See ${name}.log`);
   console.log(`PASS ${name}: ${dirs.length} isolated databases`);
 }
@@ -76,8 +81,9 @@ async function check(name, overrides = {}, signal) {
     check('parallel-1'),
     check('parallel-2', { RUST_LOG: 'error' }),
   ]);
-  for (const result of parallel)
+  for (const result of parallel) {
     if (result.status === 'rejected') throw result.reason;
+  }
   await check('migration-failure', {
     PRISMA_SCHEMA_ENGINE_BINARY: join(evidence, 'missing-engine'),
   });