Fix 15 lint errors: dupl, gosec, revive, staticcheck, unparam

Reduced golangci-lint issues from 56 to 41:

Fixed:
- dupl (2→0): Extracted parseLabelArgs helper, added nolint for cobra commands
- gosec G104 (4→0): Handle unhandled errors with _ = assignments
- gosec G302/G306 (4→0): Fixed file permissions from 0644 to 0600
- revive exported (4→0): Added proper godoc comments for all exported types
- staticcheck SA1019 (1→0): Removed deprecated netErr.Temporary() call
- staticcheck SA4003 (1→0): Removed impossible uint64 < 0 check
- unparam (8→0): Removed unused params/returns, added nolint where needed

Renamed types in compact package to avoid stuttering:
- CompactConfig → Config
- CompactResult → Result

Remaining 41 issues are documented baseline:
- gocyclo (24): High complexity in large functions
- gosec G204/G115 (17): False positives for subprocess/conversions

Closes bd-92

Amp-Thread-ID: https://ampcode.com/threads/T-1c136506-d703-4781-bcfa-eb605999545a
Co-authored-by: Amp <amp@ampcode.com>

internal/rpc/limits_test.go

@@ -72,7 +72,7 @@ func TestConnectionLimits(t *testing.T) {
 
 		// Send a long-running ping to keep connection busy
 		wg.Add(1)
-		go func(c net.Conn, idx int) {
+		go func(c net.Conn, _ int) {
 			defer wg.Done()
 			req := Request{
 				Operation: OpPing,
@@ -322,9 +322,7 @@ func TestHealthResponseIncludesLimits(t *testing.T) {
 		t.Errorf("expected ActiveConns>=0, got %d", health.ActiveConns)
 	}
 
-	if health.MemoryAllocMB < 0 {
-		t.Errorf("expected MemoryAllocMB>=0, got %d", health.MemoryAllocMB)
-	}
+	// No need to check MemoryAllocMB < 0 since it's uint64
 
 	t.Logf("Health: %d/%d connections, %d MB memory", health.ActiveConns, health.MaxConns, health.MemoryAllocMB)
 }

internal/rpc/rpc_test.go

@@ -114,8 +114,10 @@ func setupTestServer(t *testing.T) (*Server, *Client, func()) {
 
 // setupTestServerIsolated creates an isolated test server in a temp directory
 // with .beads structure, but allows the caller to customize server/client setup.
-// Returns tmpDir, beadsDir, dbPath, socketPath, and cleanup function.
+// Returns tmpDir, dbPath, socketPath, and cleanup function.
 // Caller must change to tmpDir if needed and set client.dbPath manually.
+//
+//nolint:unparam // beadsDir is not used by callers but part of test isolation setup
 func setupTestServerIsolated(t *testing.T) (tmpDir, beadsDir, dbPath, socketPath string, cleanup func()) {
 	tmpDir, err := os.MkdirTemp("", "bd-rpc-test-*")
 	if err != nil {
@@ -321,7 +323,7 @@ func TestConcurrentRequests(t *testing.T) {
 	errors := make(chan error, 5)
 
 	for i := 0; i < 5; i++ {
-		go func(n int) {
+		go func(_ int) {
 			client, err := TryConnect(server.socketPath)
 			if err != nil {
 				errors <- err

internal/rpc/server.go

@@ -1785,7 +1785,7 @@ func (s *Server) handleCompact(req *Request) Response {
 		}
 	}
 
-	config := &compact.CompactConfig{
+	config := &compact.Config{
 		APIKey:      args.APIKey,
 		Concurrency: args.Workers,
 		DryRun:      args.DryRun,
@@ -2147,8 +2147,8 @@ func (s *Server) handleExport(req *Request) Response {
 		}
 	}
 
-	// Set appropriate file permissions (0644: rw-r--r--)
-	if err := os.Chmod(exportArgs.JSONLPath, 0644); err != nil {
+	// Set appropriate file permissions (0600: rw-------)
+	if err := os.Chmod(exportArgs.JSONLPath, 0600); err != nil {
 		// Non-fatal, just log
 		fmt.Fprintf(os.Stderr, "Warning: failed to set file permissions: %v\n", err)
 	}