Beta linter line numbers are off by one

Using https://github.com/MikaelSmith/cd4pe-k8s to repro. Some errors hidden for brevity

Using the tar endpoint:

tar cf - manifests | \           
                curl -sSL -XPOST --data-binary @- https://lint.replicated.com/v1/lint | \
                jq --raw-output '.lintExpressions[] | select(.positions != null) | "\(.type)\t\(.path)\t\(.positions[] | .start.line)\t\(.rule)\t\(.message)"' | \
                cat <(printf "TYPE\tPATH\tLINE\tRULE\tMESSAGE\n") - | \
                column -t -s $'\t'
TYPE  PATH                         LINE  RULE                 MESSAGE
warn  manifests/config.yaml        76    invalid_type         Invalid type. Expected: string, given: boolean

but using the CLI its off by 1

$ replicated release lint --beta-linter --yaml-dir manifests/
RULE                   TYPE     FILENAME                       LINE    MESSAGE
invalid_type           warn     manifests/config.yaml          77      Invalid type. Expected: string, given: boolean    
Error: One or more errors of severity "error" or higher were found

$ nl manifests/config.yaml
     1  apiVersion: kots.io/v1beta1
     2  kind: Config
     3  metadata:
     4    name: cd4pe-config
     5  spec:
     6    groups:
     7    - name: application_setup
     8      title: Application Setup
     9      items:
    10      - name: namespace
    11        title: Kubernetes Namespace
    12        help_text: |
    13          The namespace to deploy in. The namespace needs to exist before deploying to it. Set blank to deploy to the same namespace as the admin console.
    14        type: text
    15        value: cd4pe
    16      - name: pfi_secret_key
    17        title: Database Encryption Secret Key
    18        help_text: |
    19          A 16-byte secret key used for AES encryption of secrets (such as PE access tokens) supplied to Continuous Delivery for PE.
    20          The default is not cryptographically-generated. Generate a new key by running: `dd bs=1 if=/dev/urandom count=16 2>/dev/null | base64`.
    21          Warning: changing this after initial rollout may make data in CD4PE inaccessible.
    22        type: password
    23        required: true
    24         # Uses Sprig functions to generate a (mostly) random 16-byte key
    25        value: '{{repl randAscii 16 | b64enc}}'
    26      # MinIO/PostgreSQL credentials are here to persist generated values but hidden to prevent changing them.
    27      # They should only be changed in the event of a security incident; doing so requires changing values
    28      # here (so CD4PE knows how to connect) and issuing commands to minio and postgres to change passwords.
    29      - name: postgres_user
    30        type: text
    31        hidden: true
    32        value: cd4pe
    33      - name: postgres_password
    34        type: password
    35        hidden: true
    36        value: '{{repl RandomString 24}}'
    37      - name: minio_access_key
    38        type: text
    39        hidden: true
    40        value: minio
    41      - name: minio_secret_key
    42        type: password
    43        hidden: true
    44        value: '{{repl RandomString 24}}'
    45    - name: ingress_setup
    46      title: Ingress Setup
    47      description: |
    48        Setup how the application is exposed externally.
    49      items:
    50      - name: enable_ingress
    51        type: bool
    52        title: Enable Kubernetes Ingress
    53        help_text: |
    54          Uncheck this box to disable the Kubernetes Ingress resource.
    55        default: "1"
    56      - name: hostname
    57        type: text
    58        title: Hostname
    59        help_text: |
    60          Use this field to provide a hostname for your CD4PE Application installation.
    61        required: true
    62        when: repl{{ ConfigOptionEquals "enable_ingress" "1" }}
    63      - name: allow_http
    64        type: bool
    65        title: Allow Unsecured Access through HTTP
    66        help_text: |
    67          Uncheck this box to disable HTTP traffic between the client and the load balancer.
    68        default: "1"
    69        when: repl{{ ConfigOptionEquals "enable_ingress" "1" }}
    70      - name: annotations
    71        type: textarea
    72        title: Annotations
    73        help_text: |
    74          Use this textarea to provide annotations specific to your ingress controller.
    75          For example, `kubernetes.io/ingress.class: alb` when using the ALB ingress controller.
    76        when: repl{{ ConfigOptionEquals "enable_ingress" "1" }}

Reproduce the mismatch with replicated release lint --beta-linter --yaml-dir manifests/ using the provided manifests/config.yaml, then compare its reported line with the tar endpoint's lintExpressions output. Trace the beta-linter path behind the CLI command; done means both interfaces report line 76 for the shown validation error.