fix: resolve CI lint, type-check, and security gate failures

[michaelalber]

Summary

• __main__.py — Replace assert parser is not None with an explicit RuntimeError guard (assert is stripped with -O; S101/B101). Add # nosec B404 on import subprocess and # noqa: S603 # nosec B603 on subprocess.run — the invocation uses sys.executable with hardcoded flag strings and a validated Path; not a command-injection risk.
• parser.py — Add # type: ignore[attr-defined] on the lazy AcceleratorOptions import. Docling's pipeline_options module defines no __all__, so mypy strict/no_implicit_reexport cannot verify the export; the attribute exists at runtime (confirmed with dir()).
• embeddings.py — Add # nosemgrep suppression on the truncation logger.warning. Semgrep's python-logger-credential-disclosure rule fires on chunk_index=%s — a diagnostic field, not a credential. Confirmed false positive.

Gates fixed

File	Suppression	Tool	Rule
__main__.py	assert → RuntimeError	Ruff + Bandit	S101 / B101
__main__.py	# nosec B404	Bandit	B404
__main__.py	# noqa: S603 # nosec B603	Ruff + Bandit	S603 / B603
parser.py	# type: ignore[attr-defined]	mypy	attr-defined
embeddings.py	# nosemgrep	Semgrep	python-logger-credential-disclosure

Test plan

• CI passes: Ruff, mypy, Bandit, Semgrep all green
• 319 unit tests pass (verified locally)
• No behaviour change to convert command — assert replaced with equivalent guard

🤖 Generated with Claude Code