refactor(lint): fix gocritic warnings - part 1

- Fix octal literals (0644 → 0o644)
- Pass large structs by pointer to avoid copies
- Add named return values for clarity
- Resolve import shadowing issues
- Pass huge parameters by pointer

Fixes 20 gocritic warnings across 16 files.

Co-authored-by: Codex Agent <codex@cloud-safeguard.local>