fix: Suppress gosec warnings with nolint comments

- Add nolint:gosec comments for safe file operations
- G304: File reads from validated/secure paths
- G306/G302: JSONL/error files need 0644 for sharing/debugging
- G204: Subprocess launches with validated arguments
- G104: Deferred file close errors are non-critical
- G115: Safe integer conversions in backoff
- G201: SQL placeholders for IN clause expansion

All warnings are for intentional behavior that is safe in context.

Amp-Thread-ID: https://ampcode.com/threads/T-d78f2780-4709-497f-97b0-035ca8c809e1
Co-authored-by: Amp <amp@ampcode.com>

cmd/bd/main.go

@@ -153,16 +153,16 @@ var rootCmd = &cobra.Command{
 
 		// Initialize database path
 		if dbPath == "" {
-		// Use public API to find database (same logic as extensions)
-		if foundDB := beads.FindDatabasePath(); foundDB != "" {
-		 dbPath = foundDB
-		} else {
-		 // No database found - error out instead of falling back to ~/.beads
-			fmt.Fprintf(os.Stderr, "Error: no beads database found\n")
-		 fmt.Fprintf(os.Stderr, "Hint: run 'bd init' to create a database in the current directory\n")
-		 fmt.Fprintf(os.Stderr, "      or set BEADS_DB environment variable to specify a database\n")
-		os.Exit(1)
-		}
+			// Use public API to find database (same logic as extensions)
+			if foundDB := beads.FindDatabasePath(); foundDB != "" {
+				dbPath = foundDB
+			} else {
+				// No database found - error out instead of falling back to ~/.beads
+				fmt.Fprintf(os.Stderr, "Error: no beads database found\n")
+				fmt.Fprintf(os.Stderr, "Hint: run 'bd init' to create a database in the current directory\n")
+				fmt.Fprintf(os.Stderr, "      or set BEADS_DB environment variable to specify a database\n")
+				os.Exit(1)
+			}
 		}
 
 		// Set actor from flag, viper (env), or default
@@ -343,6 +343,7 @@ var rootCmd = &cobra.Command{
 						// Check for daemon-error file to provide better error message
 						if beadsDir := filepath.Dir(socketPath); beadsDir != "" {
 							errFile := filepath.Join(beadsDir, "daemon-error")
+							// nolint:gosec // G304: errFile is derived from secure beads directory
 							if errMsg, readErr := os.ReadFile(errFile); readErr == nil && len(errMsg) > 0 {
 								fmt.Fprintf(os.Stderr, "\n%s\n", string(errMsg))
 								daemonStatus.Detail = string(errMsg)