Fix gosec security warnings (bd-57)

- Changed file permissions from 0644 → 0600 for JSONL exports and config files
- Changed directory permissions from 0755 → 0750 in all test code
- Updated .golangci.yml with proper exclusions for false positives
- Reduced gosec warnings from 102 to 22 (all remaining are acceptable)

Closes bd-57

Amp-Thread-ID: https://ampcode.com/threads/T-f754d957-9e42-4e74-861e-57235c7e6436
Co-authored-by: Amp <amp@ampcode.com>

cmd/bd/sync.go

@@ -351,8 +351,8 @@ func exportToJSONL(ctx context.Context, jsonlPath string) error {
 		return fmt.Errorf("failed to replace JSONL file: %w", err)
 	}
 
-	// Set appropriate file permissions (0644: rw-r--r--)
-	if err := os.Chmod(jsonlPath, 0644); err != nil {
+	// Set appropriate file permissions (0600: rw-------)
+	if err := os.Chmod(jsonlPath, 0600); err != nil {
 		// Non-fatal warning
 		fmt.Fprintf(os.Stderr, "Warning: failed to set file permissions: %v\n", err)
 	}