Address PR #2045 review (umputun): * The //nolint:gosec on telegramQrCtrl's w.Write(png) was byte-identical to the same line in #2044 (gosec-rule restoration). Drop it here so the two PRs do not conflict; #2044 owns it. * `seg == ".."` in safePictureSegment was already covered by the strings.Contains(seg, "..") check two lines down — trim and add an inline comment so the cover-by-superset is explicit.