Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `operator/bundle_helpers/cmd/fix_descriptors.go:63-64` </location>
<code_context>
+// This handles formatting quirks (quote styles, line wrapping, etc.) while keeping
+// all business logic in Go.
+func normalizeYAMLOutput(goYAML []byte, w io.Writer) error {
+	wd, _ := os.Getwd()
+	normalizerPath := filepath.Join(wd, "bundle_helpers", "yaml-normalizer.py")
+
+	// Run the normalizer
</code_context>

<issue_to_address>
**issue (bug_risk):** YAML normalizer path is likely incorrect when run via dispatch.sh (ends up with bundle_helpers/bundle_helpers/...)

Because `dispatch.sh` runs `go run` from `.../bundle_helpers`, `os.Getwd()` will already be `.../bundle_helpers`. Joining `bundle_helpers/yaml-normalizer.py` produces `.../bundle_helpers/bundle_helpers/yaml-normalizer.py`, which doesn’t exist, so normalization will always fail.

Resolve the script path relative to the source file or executable (e.g., via `os.Executable()` or an embed-based approach). If you can rely on the current working directory being `bundle_helpers`, just join `yaml-normalizer.py` directly instead of adding the extra directory level.
</issue_to_address>

### Comment 2
<location> `operator/bundle_helpers/pkg/rewrite/rewriter_test.go:19` </location>
<code_context>
+		{
+			name:     "bare string cannot be modified",
</code_context>

<issue_to_address>
**suggestion (testing):** Consider a test where nested structures are traversed but no replacements occur to assert modified=false

Adding a case where nested structures are traversed but no values match `old`, and asserting `RewriteStrings` returns `false` and leaves the structure unchanged, would help ensure `modified` isn’t incorrectly set just because traversal occurred.
</issue_to_address>

### Comment 3
<location> `operator/bundle_helpers/cmd/fix_descriptors.go:67` </location>
<code_context>
	cmd := exec.Command(normalizerPath)
</code_context>

<issue_to_address>
**security (go.lang.security.audit.dangerous-exec-command):** Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.

*Source: opengrep*
</issue_to_address>