fix: resolve all golangci-lint errors

Fixes 15 pre-existing lint issues:

errcheck (6 issues):
- mol_distill.go: Add _ = for f.Close() and os.Remove()
- routed.go: Add _ = for routedStorage.Close() (4 locations)

gosec (8 issues):
- maintenance.go, routes.go: Add nolint for G304 (file paths from known dirs)
- mol_distill.go: Add nolint for G304 (file creation in known search paths)
- formula.go: Change WriteFile permissions from 0644 to 0600 (G306)
- gate.go: Add nolint for G204 (exec.Command with trusted AwaitID fields)

misspell (1 issue):
- gate.go: Fix "cancelled" -> "canceled" in comment

unparam (2 issues):
- cook.go, controlflow.go: Add nolint for functions returning always-nil error

Also:
- Update pre-commit-hooks to v6.0.0
- Add lint step to "Landing the Plane" session-end protocol

AGENT_INSTRUCTIONS.md

@@ -99,7 +99,10 @@ The 30-second debounce provides a **transaction window** for batch operations -
 **MANDATORY WORKFLOW - COMPLETE ALL STEPS:**
 
 1. **File beads issues for any remaining work** that needs follow-up
-2. **Ensure all quality gates pass** (only if code changes were made) - run tests, linters, builds (file P0 issues if broken)
+2. **Ensure all quality gates pass** (only if code changes were made):
+   - Run `make lint` or `golangci-lint run ./...` (if pre-commit installed: `pre-commit run --all-files`)
+   - Run `make test` or `go test ./...`
+   - File P0 issues if quality gates are broken
 3. **Update beads issues** - close finished work, update status
 4. **PUSH TO REMOTE - NON-NEGOTIABLE** - This step is MANDATORY. Execute ALL commands below:
    ```bash