fix(lint): address gosec, misspell, and unparam warnings

- gate.go: fix "cancelled" → "canceled" misspelling, add #nosec for
  validated GitHub IDs in exec.Command, mark checkTimer escalated as
  intentionally false, rename unused ctx param
- sync_divergence.go: add #nosec for git commands with validated paths,
  mark unused path param
- sync_branch.go: add #nosec for .git/info/exclude permissions
- setup.go: add #nosec for config file permissions
- recipes.go: add #nosec for validated config file paths
- external_deps.go: add #nosec for SQL with generated placeholders

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/storage/sqlite/external_deps.go

@@ -257,6 +257,7 @@ func checkProjectCapabilities(ctx context.Context, project string, capabilities
 	}
 
 	// Query returns which provides: labels exist on closed issues
+	// #nosec G202 -- placeholders are generated as "?" markers, not user input
 	query := `
 		SELECT DISTINCT l.label FROM labels l
 		JOIN issues i ON l.issue_id = i.id