fix: suppress gosec lint warnings for file operations

All file reads/writes are from controlled paths (.beads/, .git/, or git root).
Add #nosec comments to suppress G304 and G204 warnings.

- cmd/bd/doctor.go:664 - ReadFile from .beads/config.yaml
- cmd/bd/main.go:645 - ReadFile from .beads/{issues,beads}.jsonl
- cmd/bd/doctor/fix/database_config.go:166 - ReadFile from git root .gitattributes
- cmd/bd/doctor/fix/untracked.go:61 - exec Command with whitelisted JSONL files

cmd/bd/doctor.go

@@ -661,6 +661,7 @@ func checkDatabaseVersion(path string) doctorCheck {
 			// Check config.yaml for no-db: true
 			configPath := filepath.Join(beadsDir, "config.yaml")
 			isNoDbMode := false
+			// #nosec G304 -- configPath is constructed from beadsDir which is in .beads/
 			if configData, err := os.ReadFile(configPath); err == nil {
 				// Simple check for no-db: true in config.yaml
 				isNoDbMode = strings.Contains(string(configData), "no-db: true")