Fix for Writable file handle closed without error handling

[alxxjohn]

To fix this safely without changing intended behavior, replace the bare defer dst.Close() with a deferred closure that captures and propagates any close error when no earlier error is already being returned. The cleanest pattern in Go is to use a named return value (err error) in copyFile, then in defer set err = closeErr only if err == nil.

In internal/codeguard/runner/support/diff_command.go, update copyFile:

• Change signature to func copyFile(...) (err error).
• Keep src close as best-effort (read handle; not the CodeQL finding).
• Replace defer dst.Close() with:
  • defer func() { if closeErr := dst.Close(); err == nil && closeErr != nil { err = closeErr } }()
• Keep the final io.Copy call assigning to err and returning it.
  This ensures close failures on the writable destination are not silently dropped.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.