lint(migrate): delete a dead complexity directive, argue the live one - #387

Phase 1b-iv of the issue #365 audit remediation — the last active 1b item, and
comment-only: no behavior changes, no signatures touched.

applyGraphModifications loses its //nolint:gocognit. The function measures
gocognit 8 against a threshold of 20; the directive suppressed nothing, and a
suppression that suppresses nothing is misinformation for the next audit.

buildTree (gocognit 23) keeps its suppression, converted to the argued form the
repository's convention requires: one WalkDir filter, a guard chain whose
branches return distinct sentinels (SkipDir vs nil), where splitting the chain
across helpers fragments a single coherent filter. The verdict from the
per-function ruling: flattening does not apply (it is already flat) and
extraction makes it harder to read, not easier.

Bare nolint directives across the tree: 3 -> 1. The survivor is
buildMultiSource, deliberately parked on issue #369 — its collision predicate's
only reachable branch has undefined behavior under the current unstable sort,
so no behavior-preserving refactor of it exists to write.

Final accounting for the audit's nine live complexity suppressions: six
decomposed (1b-i, 1b-ii), one deleted as dead-on-a-live-function (this commit),
one argued (this commit), one parked on the #369 correctness bug. Phase 1b's
active work is closed.

Verified: make vet green, full make test green — zero FAIL or panic lines by
count; gofmt clean.
Plan: docs/plans/audit-remediation.md (phase 1b-iv, flipped to completed here).
Issue: #365