fix(ci): update golangci-lint exclusions and increase Windows timeout

- Add daemon_autostart.go, doctor/fix/sync_branch.go to G304 exclusions
- Add setup.go to G306 exclusions (config files need 0644)
- Add gate.go, gate_discover.go to G204 exclusions (gh/gt CLI calls)
- Add misspell exclusion for "cancelled" in gate.go (matches GitHub API)
- Increase Windows test timeout to 30m (was timing out at 20m)

These exclusions complement the #nosec annotations already in the code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
           # Windows: full test suite, no race detector (slower on Windows)
           - os: windows-latest
             coverage: false
-            test-flags: '-v -short -timeout=20m'
+            test-flags: '-v -short -timeout=30m'
     steps:
       - uses: actions/checkout@v6
 

.golangci.yml

@@ -45,7 +45,7 @@ linters:
           - gosec
         text: "G306"
       # G304: Safe file reads from known JSONL and error paths
-      - path: 'cmd/bd/autoflush\.go|internal/beads/beads\.go|internal/daemon/discovery\.go|internal/daemonrunner/sync\.go|internal/syncbranch/worktree\.go'
+      - path: 'cmd/bd/autoflush\.go|cmd/bd/daemon_autostart\.go|cmd/bd/doctor/fix/sync_branch\.go|internal/beads/beads\.go|internal/daemon/discovery\.go|internal/daemonrunner/sync\.go|internal/syncbranch/worktree\.go'
         linters:
           - gosec
         text: "G304"
@@ -54,7 +54,7 @@ linters:
           - gosec
         text: "G302.*0700|G301.*0750"
       # G302/G306: JSONL files and error logs need 0644 for debugging/sharing
-      - path: 'cmd/bd/autoflush\.go|cmd/bd/daemon\.go|cmd/bd/daemon_sync_branch\.go|internal/daemon/registry\.go|internal/daemonrunner/daemon\.go|internal/git/worktree\.go'
+      - path: 'cmd/bd/autoflush\.go|cmd/bd/daemon\.go|cmd/bd/daemon_sync_branch\.go|cmd/bd/setup\.go|internal/daemon/registry\.go|internal/daemonrunner/daemon\.go|internal/git/worktree\.go'
         linters:
           - gosec
         text: "G306"
@@ -64,7 +64,7 @@ linters:
           - gosec
         text: "G306.*0700"
       # G204: Safe subprocess launches with validated arguments
-      - path: 'cmd/bd/daemon_autostart\.go|cmd/bd/daemon_sync_branch\.go|cmd/bd/doctor\.go|cmd/bd/doctor/fix/sync_branch\.go|cmd/bd/jira\.go|cmd/bd/migrate_sync\.go|cmd/bd/show\.go|cmd/bd/sync\.go|internal/git/worktree\.go|internal/syncbranch/worktree\.go'
+      - path: 'cmd/bd/daemon_autostart\.go|cmd/bd/daemon_sync_branch\.go|cmd/bd/doctor\.go|cmd/bd/doctor/fix/sync_branch\.go|cmd/bd/gate\.go|cmd/bd/gate_discover\.go|cmd/bd/jira\.go|cmd/bd/migrate_sync\.go|cmd/bd/show\.go|cmd/bd/sync\.go|internal/git/worktree\.go|internal/syncbranch/worktree\.go'
         linters:
           - gosec
         text: 'G204'
@@ -94,6 +94,11 @@ linters:
         linters:
           - unparam
         text: 'reimportConflicts|resolveConflictsByTimestamp'
+      # misspell: "cancelled" is intentional - matching GitHub API response values
+      - path: 'cmd/bd/gate\.go'
+        linters:
+          - misspell
+        text: 'cancelled'
 
 issues:
   uniq-by-line: true