Fix gosec security warnings (bd-57)

- Changed file permissions from 0644 → 0600 for JSONL exports and config files
- Changed directory permissions from 0755 → 0750 in all test code
- Updated .golangci.yml with proper exclusions for false positives
- Reduced gosec warnings from 102 to 22 (all remaining are acceptable)

Closes bd-57

Amp-Thread-ID: https://ampcode.com/threads/T-f754d957-9e42-4e74-861e-57235c7e6436
Co-authored-by: Amp <amp@ampcode.com>

beads_test.go

@@ -52,7 +52,7 @@ func TestFindDatabasePathInTree(t *testing.T) {
 
 	// Create .beads directory with a database file
 	beadsDir := filepath.Join(tmpDir, ".beads")
-	err = os.MkdirAll(beadsDir, 0o755)
+	err = os.MkdirAll(beadsDir, 0o750)
 	if err != nil {
 		t.Fatalf("Failed to create .beads dir: %v", err)
 	}
@@ -66,7 +66,7 @@ func TestFindDatabasePathInTree(t *testing.T) {
 
 	// Create a subdirectory and change to it
 	subDir := filepath.Join(tmpDir, "sub", "nested")
-	err = os.MkdirAll(subDir, 0o755)
+	err = os.MkdirAll(subDir, 0o750)
 	if err != nil {
 		t.Fatalf("Failed to create subdirectory: %v", err)
 	}