Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `internal/generators.go:36` </location>
<code_context>
+	return docComment{Text: doccomment, Start: startpos, End: endpos}, nil
+}
+
+func SetDocComment(path string, comment string) error {
+	comment = "/*\n" + comment + "*/\n"
+	oldComment, err := getDocComment(path)
</code_context>

<issue_to_address>
**issue (bug_risk):** File permissions are not preserved when writing the updated file.

os.WriteFile is called with a permission mode of 0, which removes all permissions. Pass the original file's permissions from Stat().Mode() to preserve them.
</issue_to_address>

### Comment 2
<location> `internal/build.go:13` </location>
<code_context>
+)
+
+// Cleans up the tmp directory created by Build()
+func RemoveBuildDir(bin string) {
+	buildDir := filepath.Dir(bin)
+	if err := os.RemoveAll(buildDir); err != nil {
</code_context>

<issue_to_address>
**suggestion (bug_risk):** RemoveBuildDir panics if it cannot remove the directory.

Instead of panicking, log or return the error to avoid unexpected crashes during cleanup, especially when used with defer.

Suggested implementation:

```golang
import (
	"fmt"
	"log"
	"os"
	"os/exec"
	"path/filepath"
	"runtime"
	"strings"
)

```

```golang
// Cleans up the tmp directory created by Build()
func RemoveBuildDir(bin string) {
	buildDir := filepath.Dir(bin)
	if err := os.RemoveAll(buildDir); err != nil {
		log.Printf("cannot remove temporary directory used for build output: %v", err)
	}
}

```
</issue_to_address>

### Comment 3
<location> `cmd/snaggle/update_docstring_and_readme.go:23` </location>
<code_context>
+	. "github.com/MusicalNinjaDad/snaggle/internal"
+)
+
+func main() {
+	exitcode := 0
+
</code_context>

<issue_to_address>
**issue (complexity):** Consider refactoring repeated error handling and file update logic into helper functions to clarify intent and reduce boilerplate.

```go
// helpers.go
package main

import (
    "fmt"
    "os"
    "os/exec"

    "github.com/MusicalNinjaDad/snaggle/internal"
    "golang.org/x/exp/slices"
)

// must is a helper that exits with code 3 on error.
func must(err error) {
    if err != nil {
        fmt.Fprintln(os.Stderr, err)
        os.Exit(3)
    }
}

// mustHash returns the file’s hash or exits with code 3.
func mustHash(path string) []byte {
    h, err := internal.HashFile(path)
    if err != nil {
        fmt.Fprintln(os.Stderr, err)
        os.Exit(3)
    }
    return h
}

// runOrExit runs a command and returns its stdout or exits with code 3.
func runOrExit(name string, args ...string) []byte {
    out, err := exec.Command(name, args...).Output()
    if err != nil {
        fmt.Fprintln(os.Stderr, err)
        os.Exit(3)
    }
    return out
}

// updateAndDetect applies updateFn to a file and returns true if its hash changed.
func updateAndDetect(path string, updateFn func()) bool {
    before := mustHash(path)
    updateFn()
    after := mustHash(path)
    return !slices.Equal(before, after)
}
```

```go
// main.go (refactored)
package main

import (
    "fmt"
    "os"
    "path/filepath"
    "runtime"

    "github.com/MusicalNinjaDad/snaggle/internal"
)

func main() {
    exitcode := 0
    _, thisFile, _, _ := runtime.Caller(0)
    thisDir := filepath.Dir(thisFile)
    workspaceRoot := filepath.Join(thisDir, "../..")

    // 1) Update main.go doc comment
    mainGo := filepath.Join(thisDir, "main.go")
    snaggleBin := Build(nil)
    help := runOrExit(snaggleBin, "--help")

    if updateAndDetect(mainGo, func() {
        must(SetDocComment(mainGo, string(help)))
        runOrExit("go", "fmt", mainGo)
    }) {
        fmt.Fprintf(os.Stderr, "%s updated\n", mainGo)
        exitcode = 1
    }

    // 2) Update README.md code block
    readme := filepath.Join(workspaceRoot, "README.md")
    orig := mustHash(readme)

    // ReplaceBetween reads, updates, and writes the file in one step
    updated := ReplaceBetweenFile(readme, "snaggle --help", "```", help)
    must(os.WriteFile(readme, updated, 0644))

    if !slices.Equal(orig, mustHash(readme)) {
        fmt.Fprintf(os.Stderr, "%s updated\n", readme)
        exitcode = 1
    }

    os.Exit(exitcode)
}
```

Steps to apply:

1. Pull out the repeated error-checking into `must`, `mustHash`, and `runOrExit`.
2. Introduce `updateAndDetect` to handle the hash-compare-update pattern for any file.
3. Simplify `main()` to two high-level blocks (one for `main.go`, one for `README.md`), each invoking the helpers.
4. Add a `ReplaceBetweenFile` (or similar) to encapsulate read/modify/write for README.

This preserves all behavior, eliminates boilerplate, and makes each block’s intent clear.
</issue_to_address>

### Comment 4
<location> `internal/copy.go:15` </location>
<code_context>
+//
+// Errors returned will be of type [*fs.PathError] (unless they came from [io.Copy],
+// which sadly doesn't document error details ...)
+func Copy(sourcePath string, target string) error {
+	src, err := os.Open(sourcePath)
+	if err != nil {
</code_context>

<issue_to_address>
**issue (complexity):** Consider consolidating deferred resource cleanup and reducing repeated type casts to simplify the Copy function.

Here are two small refactorings that preserve exactly the same behavior, but remove a handful of defers and eliminate all of the repeated `Sys().(*syscall.Stat_t)` casts:

1) consolidate `Close` / `Sync` into a single defer  
2) do the `Stat_t` cast once for `src` (and once for the error‐branch `dst`)

```go
func Copy(sourcePath, target string) (err error) {
    src, err := os.Open(sourcePath)
    if err != nil {
        return err
    }
    // only need one defer for Close(src)
    defer func() {
        if c := src.Close(); c != nil {
            err = errors.Join(err, c)
        }
    }()

    srcInfo, err := src.Stat()
    if err != nil {
        return err
    }
    st := srcInfo.Sys().(*syscall.Stat_t)
    su, sg := int(st.Uid), int(st.Gid)

    dst, err := os.OpenFile(target,
        os.O_WRONLY|os.O_CREATE|os.O_EXCL,
        srcInfo.Mode(),
    )
    if err != nil {
        return err
    }
    // single defer for Sync+Close(dst)
    defer func() {
        if s := dst.Sync(); s != nil {
            err = errors.Join(err, s)
        }
        if c := dst.Close(); c != nil {
            err = errors.Join(err, c)
        }
    }()

    if _, err := io.Copy(dst, src); err != nil {
        return err
    }

    if ch := dst.Chown(su, sg); ch != nil {
        switch {
        case errors.Is(ch, syscall.EPERM):
            // ignore
        default:
            // get actual ownership to include in the error
            dsts, _ := dst.Stat()
            dt := dsts.Sys().(*syscall.Stat_t)
            du, dg := int(dt.Uid), int(dt.Gid)
            return fmt.Errorf("%w (src: %d:%d, dst: %d:%d)", ch, su, sg, du, dg)
        }
    }
    return nil
}
```

This keeps all of your ownership and error‐joining logic exactly the same but:

- removes two extra deferred closures  
- avoids repeating `Sys().(*syscall.Stat_t)` four times, replacing them with a single cast and local `su, sg` (and `du, dg` in the EPERM branch)
</issue_to_address>

### Comment 5
<location> `cmd/snaggle/update_docstring_and_readme.go:39` </location>
<code_context>
	helptext, err := exec.Command(snaggleBin, "--help").Output()
</code_context>

<issue_to_address>
**security (go.lang.security.audit.dangerous-exec-command):** Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

*Source: opengrep*
</issue_to_address>