fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/session/manager.go

@@ -440,7 +440,7 @@ func (m *Manager) StopAll(force bool) error {
 // This makes the work visible via 'gt hook' when the session starts.
 func (m *Manager) hookIssue(issueID, agentID, workDir string) error {
 	// Use bd update to set status=hooked and assign to the polecat
-	cmd := exec.Command("bd", "update", issueID, "--status=hooked", "--assignee="+agentID)
+	cmd := exec.Command("bd", "update", issueID, "--status=hooked", "--assignee="+agentID) //nolint:gosec // G204: bd is a trusted internal tool
 	cmd.Dir = workDir
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {