fix: resolve golangci-lint errors (errcheck, gosec, unparam)

- orphans.go: check fmt.Scanln return value
- edit.go: #nosec G204 for trusted $EDITOR execution
- sync_git.go: #nosec G204 for git commands with internal branch names
- worktree_cmd.go: #nosec G304/G306 for .gitignore file operations
- migrations: handle rows.Close() error
- doctor_pollution.go: mark unused path parameter

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cmd/bd/worktree_cmd.go

@@ -565,6 +565,7 @@ func addToGitignore(repoRoot, entry string) error {
 	gitignorePath := filepath.Join(repoRoot, ".gitignore")
 
 	// Read existing content
+	// #nosec G304 -- gitignorePath is constructed from known repoRoot
 	content, err := os.ReadFile(gitignorePath)
 	if err != nil && !os.IsNotExist(err) {
 		return err
@@ -579,6 +580,7 @@ func addToGitignore(repoRoot, entry string) error {
 	}
 
 	// Append entry
+	// #nosec G304 -- gitignorePath is constructed from known repoRoot
 	f, err := os.OpenFile(gitignorePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 	if err != nil {
 		return err
@@ -603,6 +605,7 @@ func addToGitignore(repoRoot, entry string) error {
 func removeFromGitignore(repoRoot, entry string) error {
 	gitignorePath := filepath.Join(repoRoot, ".gitignore")
 
+	// #nosec G304 -- gitignorePath is constructed from known repoRoot
 	content, err := os.ReadFile(gitignorePath)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -629,6 +632,7 @@ func removeFromGitignore(repoRoot, entry string) error {
 		newLines = append(newLines, line)
 	}
 
+	// #nosec G306 -- .gitignore should be world-readable
 	return os.WriteFile(gitignorePath, []byte(strings.Join(newLines, "\n")), 0644)
 }