fix: Add nolint comments for gosec/errcheck/unparam warnings

Fixes CI lint failures by adding appropriate nolint directives for:
- G204 (subprocess with variable) - git commands with trusted inputs
- G304 (file inclusion via variable) - paths from internal helpers
- G302/G306 (file permissions) - .gitignore needs 0644
- errcheck (unchecked return values) - fmt.Fprint* to stdout/stderr
- unparam (unused parameters) - reserved for future use

cmd/bd/compact_tombstone.go

@@ -284,7 +284,7 @@ func purgeTombstonesByDependency(dryRun bool) (*PurgeTombstonesResult, error) {
 	}
 
 	// Read all issues
-	file, err := os.Open(issuesPath)
+	file, err := os.Open(issuesPath) //nolint:gosec // G304: issuesPath from beads.FindBeadsDir()
 	if err != nil {
 		return nil, fmt.Errorf("failed to open issues.jsonl: %w", err)
 	}