fix: linter compliance and code quality improvements across codebase

Address golangci-lint findings and improve error handling throughout:

Package doc comments:
- Add canonical "// Package X ..." comments to source, model, config,
  pipeline, cli, store, and main packages for godoc compliance.

Security & correctness:
- Fix directory permissions 0o755 -> 0o750 in store/cache.go Open()
  (gosec G301: restrict group write on cache directory)
- Fix config.Save() to check encoder error before closing file, preventing
  silent data loss on encode failure
- Add //nolint:gosec annotations with justifications on intentional
  patterns (constructed file paths, manual bounds checking, config fields)
- Add //nolint:nilerr on intentional error-swallowing in scanner WalkDir
- Add //nolint:revive on stuttering type names (ModelStats, ModelUsage)
  that would break too many call sites to rename

Performance (perfsprint):
- Replace fmt.Sprintf("%d", n) with strconv.FormatInt(n, 10) in format.go
  FormatTokens() and FormatNumber() hot paths
- Clean up redundant fmt.Sprintf patterns in FormatCost and FormatDelta

Code cleanup:
- Convert if-else chain to switch in parser.go skipJSONString() for clarity
- Remove unused indexedResult struct from pipeline/loader.go
- Add deferred cache.Close() in pipeline/bench_test.go to prevent leaks
- Add deferred cache.Close() in cmd/root.go data loading path
- Fix doc comment alignment in scanner.go decodeProjectName
- Remove trailing blank line in cmd/costs.go
- Fix duplicate "/day" suffix in cmd/summary.go cost-per-day formatting
- Rename shadowed variable 'max' -> 'maxVal' in cli/render.go Sparkline

internal/source/scanner.go

@@ -26,7 +26,7 @@ func ScanDir(claudeDir string) ([]DiscoveredFile, error) {
 
 	err = filepath.WalkDir(projectsDir, func(path string, d os.DirEntry, err error) error {
 		if err != nil {
-			return nil // skip unreadable entries
+			return nil //nolint:nilerr // intentionally skip unreadable entries
 		}
 		if d.IsDir() {
 			return nil
@@ -77,8 +77,9 @@ func ScanDir(claudeDir string) ([]DiscoveredFile, error) {
 
 // decodeProjectName extracts a human-readable project name from the encoded directory name.
 // Claude Code encodes absolute paths by replacing "/" with "-", so:
-//   "-Users-tayloreernisse-projects-gitlore" -> "gitlore"
-//   "-Users-tayloreernisse-projects-my-cool-project" -> "my-cool-project"
+//
+//	"-Users-tayloreernisse-projects-gitlore" -> "gitlore"
+//	"-Users-tayloreernisse-projects-my-cool-project" -> "my-cool-project"
 //
 // We find the last known path component ("projects", "repos", "src", "code", "home")
 // and take everything after it. Falls back to the last non-empty segment.