fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/cmd/polecat_cycle.go

@@ -82,15 +82,15 @@ func cyclePolecatSession(direction int, sessionOverride string) error {
 // parsePolecatSessionName extracts rig and polecat name from a tmux session name.
 // Format: gt-<rig>-<name> where name is NOT crew-*, witness, or refinery.
 // Returns empty strings and false if the format doesn't match.
-func parsePolecatSessionName(sessionName string) (rigName, polecatName string, ok bool) {
+func parsePolecatSessionName(sessionName string) (rigName, polecatName string, ok bool) { //nolint:unparam // polecatName kept for API consistency
 	// Must start with "gt-"
 	if !strings.HasPrefix(sessionName, "gt-") {
 		return "", "", false
 	}
 
 	// Exclude town-level sessions by exact match
-	mayorSession, _ := getMayorSessionName()
-	deaconSession, _ := getDeaconSessionName()
+	mayorSession := getMayorSessionName()
+	deaconSession := getDeaconSessionName()
 	if sessionName == mayorSession || sessionName == deaconSession {
 		return "", "", false
 	}
@@ -133,7 +133,7 @@ func parsePolecatSessionName(sessionName string) (rigName, polecatName string, o
 // findRigPolecatSessions returns all polecat sessions for a given rig.
 // Uses tmux list-sessions to find sessions matching gt-<rig>-<name> pattern,
 // excluding crew, witness, and refinery sessions.
-func findRigPolecatSessions(rigName string) ([]string, error) {
+func findRigPolecatSessions(rigName string) ([]string, error) { //nolint:unparam // error return kept for future use
 	cmd := exec.Command("tmux", "list-sessions", "-F", "#{session_name}")
 	out, err := cmd.Output()
 	if err != nil {