fix: resolve all golangci-lint errors

Fixes 15 pre-existing lint issues:

errcheck (6 issues):
- mol_distill.go: Add _ = for f.Close() and os.Remove()
- routed.go: Add _ = for routedStorage.Close() (4 locations)

gosec (8 issues):
- maintenance.go, routes.go: Add nolint for G304 (file paths from known dirs)
- mol_distill.go: Add nolint for G304 (file creation in known search paths)
- formula.go: Change WriteFile permissions from 0644 to 0600 (G306)
- gate.go: Add nolint for G204 (exec.Command with trusted AwaitID fields)

misspell (1 issue):
- gate.go: Fix "cancelled" -> "canceled" in comment

unparam (2 issues):
- cook.go, controlflow.go: Add nolint for functions returning always-nil error

Also:
- Update pre-commit-hooks to v6.0.0
- Add lint step to "Landing the Plane" session-end protocol

internal/formula/controlflow.go

@@ -212,6 +212,8 @@ func expandLoopWithVars(step *Step, vars map[string]string) ([]*Step, error) {
 // expandLoopIteration expands a single iteration of a loop.
 // The iteration index is used to generate unique step IDs.
 // The iterVars map contains loop variable bindings for this iteration (gt-8tmz.27).
+//
+//nolint:unparam // error return kept for API consistency with future error handling
 func expandLoopIteration(step *Step, iteration int, iterVars map[string]string) ([]*Step, error) {
 	result := make([]*Step, 0, len(step.Loop.Body))