feat: apply the third-party review fixes to exit codes, parsing, config and tooling

[bastgau]

Summary

Apply the fixes and improvements agreed after the third-party review of the project (reports in review/, with the status of each point).

• Exit codes: 2 for an invalid config, a missing path, or an unreadable or unparsable file, 3 for an internal error, with every message on stderr and the other files still linted.
• Config: value types validated, exclude globs fixed, select = ["ALL"] honoured in overrides, path patterns resolved from the config file directory.
• AST extraction: nested scopes, compound blocks, @overload, main guard, dotted and re-raised exceptions (named or bare), first parameter by position, tuple attribute assignments.
• Type comparison by level (type_matching: strict, equivalent, lenient), , optional, forward references and unions handled.
• Napoleon sections, aliases and Keyword Args recognized; indentation and imperative_mood reworked; raises_extraneous split out of raises_match.
• google convention preset, and the options exclude_dunder_methods, exclude_private, exclude_overridden, properties_as_attributes, init_args_location, documented_stars, sections_optional_on_one_liners.
• Inline suppression: # docstring-linter: ignore[rule, ...] at the end of a def or class line (the opening line of the docstring for a module) silences the named rules and policies of that entity, always-on rules included; without brackets, every error of the entity. An unknown name is reported with its file and line, exit code 2.
• CLI: --statistics, --force-exclude, files named on the command line always linted, auto workers by default, excluded directories not walked, always-on rules listed by --list-rules, config line and closed output pipe handled.
• Removed: the single-style abstraction with the style key and --style flag, the unused examples field, the OFF_BY_DEFAULT set and the .vulture whitelist.
• Outputs: colors only on a terminal and never with NO_COLOR, GitHub annotations escaped.
• CI and tooling: actions pinned by SHA, dotenv-linter checked by sha256, read-only permissions, Codecov token passed explicitly, GitHub Action inputs passed through environment variables and tested on the current commit, coverage threshold raised to 90, pull requests linted on all files.
• Docs: README rewritten (installation, real output, exit codes, suppressing errors, conventions, known limitations, comparison), configuration and rule pages updated, TODO.md refreshed.
• Tests: from 372 to 597, with end-to-end tests and consistency tests between the registries, the config, the docs and TESTS.md.