Fix gosec security warnings (bd-57)

- Changed file permissions from 0644 → 0600 for JSONL exports and config files
- Changed directory permissions from 0755 → 0750 in all test code
- Updated .golangci.yml with proper exclusions for false positives
- Reduced gosec warnings from 102 to 22 (all remaining are acceptable)

Closes bd-57

Amp-Thread-ID: https://ampcode.com/threads/T-f754d957-9e42-4e74-861e-57235c7e6436
Co-authored-by: Amp <amp@ampcode.com>

cmd/bd/autostart_test.go

@@ -176,7 +176,7 @@ func TestGetSocketPath(t *testing.T) {
 		localSocket := filepath.Join(beadsDir, "bd.sock")
 
 		// Create local socket file
-		if err := os.WriteFile(localSocket, []byte{}, 0644); err != nil {
+		if err := os.WriteFile(localSocket, []byte{}, 0600); err != nil {
 			t.Fatalf("Failed to create socket file: %v", err)
 		}
 		defer os.Remove(localSocket)
@@ -201,7 +201,7 @@ func TestGetSocketPath(t *testing.T) {
 		}
 		globalSocket := filepath.Join(globalBeadsDir, "bd.sock")
 
-		if err := os.WriteFile(globalSocket, []byte{}, 0644); err != nil {
+		if err := os.WriteFile(globalSocket, []byte{}, 0600); err != nil {
 			t.Fatalf("Failed to create fake global socket file: %v", err)
 		}