Remove stale RuboCop disables

- Reduce local lint noise where ordinary Ruby expresses the intent.
- Keep intentional `rubocop:disable` sites that document required choices.
- Preserve shell escaping by keeping `gsub!` replacements literal.
- Add a direct keg expectation so the spec no longer needs suppression.