fix: Suppress gosec warnings with nolint comments

- Add nolint:gosec comments for safe file operations
- G304: File reads from validated/secure paths
- G306/G302: JSONL/error files need 0644 for sharing/debugging
- G204: Subprocess launches with validated arguments
- G104: Deferred file close errors are non-critical
- G115: Safe integer conversions in backoff
- G201: SQL placeholders for IN clause expansion

All warnings are for intentional behavior that is safe in context.

Amp-Thread-ID: https://ampcode.com/threads/T-d78f2780-4709-497f-97b0-035ca8c809e1
Co-authored-by: Amp <amp@ampcode.com>

cmd/bd/daemon_autostart.go

@@ -212,6 +212,7 @@ func isDaemonHealthy(socketPath string) bool {
 }
 
 func acquireStartLock(lockPath, socketPath string) bool {
+	// nolint:gosec // G304: lockPath is derived from secure beads directory
 	lockFile, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
 	if err != nil {
 		debugLog("another process is starting daemon, waiting for readiness")
@@ -340,6 +341,7 @@ func getPIDFileForSocket(socketPath string) string {
 
 // readPIDFromFile reads a PID from a file
 func readPIDFromFile(path string) (int, error) {
+	// nolint:gosec // G304: path is derived from secure beads directory
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err