fix(lint): address gosec, misspell, and unparam warnings

- gate.go: fix "cancelled" → "canceled" misspelling, add #nosec for
  validated GitHub IDs in exec.Command, mark checkTimer escalated as
  intentionally false, rename unused ctx param
- sync_divergence.go: add #nosec for git commands with validated paths,
  mark unused path param
- sync_branch.go: add #nosec for .git/info/exclude permissions
- setup.go: add #nosec for config file permissions
- recipes.go: add #nosec for validated config file paths
- external_deps.go: add #nosec for SQL with generated placeholders

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cmd/bd/setup.go

@@ -131,7 +131,7 @@ func writeToPath(path string) error {
 		}
 	}
 
-	if err := os.WriteFile(path, []byte(recipes.Template), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte(recipes.Template), 0o644); err != nil { // #nosec G306 -- config files need to be readable
 		return fmt.Errorf("write file: %w", err)
 	}
 	return nil
@@ -225,7 +225,7 @@ func runRecipe(name string) {
 		}
 	}
 
-	if err := os.WriteFile(recipe.Path, []byte(recipes.Template), 0o644); err != nil {
+	if err := os.WriteFile(recipe.Path, []byte(recipes.Template), 0o644); err != nil { // #nosec G306 -- config files need to be readable
 		fmt.Fprintf(os.Stderr, "Error: write file: %v\n", err)
 		os.Exit(1)
 	}