fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/checkpoint/checkpoint.go

@@ -59,7 +59,7 @@ func Path(polecatDir string) string {
 func Read(polecatDir string) (*Checkpoint, error) {
 	path := Path(polecatDir)
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed from trusted polecatDir
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, nil
@@ -96,7 +96,7 @@ func Write(polecatDir string, cp *Checkpoint) error {
 	}
 
 	path := Path(polecatDir)
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0600); err != nil {
 		return fmt.Errorf("writing checkpoint: %w", err)
 	}