Drop googleapis/api direct dependency in LSP CEL

.golangci.yml

@@ -189,11 +189,6 @@ linters:
         # G115 checks for use of truncating conversions.
         path: private/buf/buflsp/semantic_tokens.go
         text: "G115:"
-      - linters:
-          - gosec
-        # G115 checks for use of truncating conversions.
-        path: private/buf/buflsp/semantic_tokens_cel.go
-        text: "G115:"
       - linters:
           - gosec
         # G115 checks for use of truncating conversions.

go.mod

@@ -45,7 +45,6 @@ require (
 	golang.org/x/sync v0.19.0
 	golang.org/x/term v0.40.0
 	golang.org/x/tools v0.42.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260217215200-42d3e9bedb6d
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/xurls/v2 v2.6.0
@@ -109,6 +108,7 @@ require (
 	golang.org/x/net v0.50.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260217215200-42d3e9bedb6d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
 	google.golang.org/grpc v1.75.1 // indirect
 )

private/buf/buflsp/cel.go

@@ -193,6 +193,15 @@ func fileByteOffsetToCELOffset(fileByteOffset int, exprLiteralSpan source.Span)
 	return -1
 }
 
+// celLocByteOffset converts a CEL source location (line, col) to a byte offset
+// within exprString. line and col come from common.Location, which returns int,
+// but ComputeOffset requires int32; the conversion is safe for any realistic
+// CEL expression length.
+func celLocByteOffset(line, col int, sourceInfo *celast.SourceInfo, exprString string) int {
+	runeOffset := int32(col) + sourceInfo.ComputeOffset(int32(line), 0) //nolint:gosec // CEL expressions are never large enough to overflow int32
+	return celRuneOffsetToByteOffset(exprString, runeOffset)
+}
+
 // celRuneOffsetToByteOffset converts a CEL source position (Unicode code point offset)
 // to a UTF-8 byte offset within the expression string.
 //