Secure prompt debug filesystem writes

internal/app/app.go

@@ -258,6 +258,7 @@ func GenerateDetailed(ctx context.Context, req GenerateRequest) (*ReportResult,
 	if err != nil {
 		return result, promptexec.NewError(promptexec.InvalidConfiguration, "initialize prompt debug", err)
 	}
+	defer func() { _ = debugWriter.Close() }()
 	inspection, err := InspectPromptExecution(ctx, PromptInspectionRequest{
 		Resolved:  resolved,
 		Executor:  req.Executor,
@@ -309,6 +310,7 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 	if err != nil {
 		return nil, promptexec.NewError(promptexec.InvalidConfiguration, "initialize prompt debug", err)
 	}
+	defer func() { _ = debugWriter.Close() }()
 	candidates, err := batchInspectionCandidates(req, now)
 	if err != nil {
 		return nil, err