chore(auto-update): address static-analysis findings

- Replace the subprocess.CompletedProcess the verifier fabricated for a
  command that could not start with a plain namedtuple; nothing is executed
  there, but the scanner flags any CompletedProcess built from variables.
- Mark the subprocess imports with the repo's standard B404 annotation (all
  calls are list-form argv, no shell).
- Mark the rollback-failed message as not SQL (B608 matched its wording).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web_interface/auto_update.py

@@ -32,7 +32,7 @@ import json
 import logging
 import os
 import shutil
-import subprocess
+import subprocess  # nosec B404 - list-form argv only, no shell  # nosemgrep
 import tempfile
 import threading
 import time
@@ -574,7 +574,7 @@ class AutoUpdater:
             state['rolled_back_head'] = new
         else:
             outcome = 'rollback_failed'
-            message = (f'The LEDMatrix update to {_short(new)} failed ({reason or "unknown reason"}) and '
+            message = (f'The LEDMatrix update to {_short(new)} failed ({reason or "unknown reason"}) and '  # nosec B608 - user-facing message, not SQL  # nosemgrep
                        f'could not be rolled back: {detail or "unknown error"}. The device may need '
                        f'attention: run "git reset --hard {old}" in the LEDMatrix folder, then restart '
                        'the display and web services.')