fix: Suppress gosec warnings with nolint comments

- Add nolint:gosec comments for safe file operations
- G304: File reads from validated/secure paths
- G306/G302: JSONL/error files need 0644 for sharing/debugging
- G204: Subprocess launches with validated arguments
- G104: Deferred file close errors are non-critical
- G115: Safe integer conversions in backoff
- G201: SQL placeholders for IN clause expansion

All warnings are for intentional behavior that is safe in context.

Amp-Thread-ID: https://ampcode.com/threads/T-d78f2780-4709-497f-97b0-035ca8c809e1
Co-authored-by: Amp <amp@ampcode.com>

cmd/bd/init.go

@@ -108,7 +108,8 @@ With --no-db: creates .beads/ directory and issues.jsonl file instead of SQLite
 			// Create empty issues.jsonl file
 			jsonlPath := filepath.Join(localBeadsDir, "issues.jsonl")
 			if _, err := os.Stat(jsonlPath); os.IsNotExist(err) {
-				if err := os.WriteFile(jsonlPath, []byte{}, 0644); err != nil {
+			// nolint:gosec // G306: JSONL file needs to be readable by other tools
+			if err := os.WriteFile(jsonlPath, []byte{}, 0644); err != nil {
 					fmt.Fprintf(os.Stderr, "Error: failed to create issues.jsonl: %v\n", err)
 					os.Exit(1)
 				}