fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/cmd/handoff.go

@@ -155,7 +155,7 @@ func runHandoff(cmd *cobra.Command, args []string) error {
 		if agent == "" {
 			agent = currentSession
 		}
-		LogHandoff(townRoot, agent, handoffSubject)
+		_ = LogHandoff(townRoot, agent, handoffSubject)
 		// Also log to activity feed
 		_ = events.LogFeed(events.TypeHandoff, agent, events.HandoffPayload(handoffSubject, true))
 	}
@@ -230,18 +230,10 @@ func resolveRoleToSession(role string) (string, error) {
 
 	switch strings.ToLower(role) {
 	case "mayor", "may":
-		mayorSession, err := getMayorSessionName()
-		if err != nil {
-			return "", fmt.Errorf("cannot determine mayor session name: %w", err)
-		}
-		return mayorSession, nil
+		return getMayorSessionName(), nil
 
 	case "deacon", "dea":
-		deaconSession, err := getDeaconSessionName()
-		if err != nil {
-			return "", fmt.Errorf("cannot determine deacon session name: %w", err)
-		}
-		return deaconSession, nil
+		return getDeaconSessionName(), nil
 
 	case "crew":
 		// Try to get rig and crew name from environment or cwd
@@ -369,8 +361,8 @@ func buildRestartCommand(sessionName string) (string, error) {
 // This is the canonical home for each role type.
 func sessionWorkDir(sessionName, townRoot string) (string, error) {
 	// Get session names for comparison
-	mayorSession, _ := getMayorSessionName()
-	deaconSession, _ := getDeaconSessionName()
+	mayorSession := getMayorSessionName()
+	deaconSession := getDeaconSessionName()
 
 	switch {
 	case sessionName == mayorSession: