fix(lint): ignore gosec on untrusted path - #230

Had a discussion with Claude:

1. Disable G304 globally in .golangci.yml if you've decided BYOH doesn't have a realistic directory-traversal surface
2. Disable it just for agent/ (lower risk, self-contained)
3. Keep it enabled but suppress in safe spots (current approach)
4. implement a custom OpenFileIn-like helper now, rather than waiting for stdlib:

   func readFileIn(dir, name string) ([]byte, error) {
       // Validates path is within dir, prevents traversal
   }
   

None of them really look satisfying to me. Therefore just commented it.