fix: Add nolint comments for gosec/errcheck/unparam warnings

Fixes CI lint failures by adding appropriate nolint directives for:
- G204 (subprocess with variable) - git commands with trusted inputs
- G304 (file inclusion via variable) - paths from internal helpers
- G302/G306 (file permissions) - .gitignore needs 0644
- errcheck (unchecked return values) - fmt.Fprint* to stdout/stderr
- unparam (unused parameters) - reserved for future use

cmd/bd/doctor_pollution.go

@@ -11,6 +11,8 @@ import (
 
 // runPollutionCheck runs detailed test pollution detection
 // This integrates the detect-pollution command functionality into doctor.
+//
+//nolint:unparam // path reserved for future use
 func runPollutionCheck(_ string, clean bool, yes bool) {
 	// Ensure we have a store initialized (uses direct mode, no daemon support yet)
 	if err := ensureDirectMode("pollution check requires direct mode"); err != nil {