fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/beads/daemon.go

@@ -111,10 +111,10 @@ func EnsureBdDaemonHealth(workDir string) string {
 }
 
 // restartBdDaemons restarts all bd daemons.
-func restartBdDaemons() error {
+func restartBdDaemons() error { //nolint:unparam // error return kept for future use
 	// Stop all daemons first
 	stopCmd := exec.Command("bd", "daemon", "killall")
-	stopCmd.Run() // Ignore errors - daemons might not be running
+	_ = stopCmd.Run() // Ignore errors - daemons might not be running
 
 	// Give time for cleanup
 	time.Sleep(200 * time.Millisecond)