Resolve audited bugs and security issues; prepare v0.1.0

[michaelishri]

Gonner could hang on failed dependencies or oversized output, lose child exit statuses and log data, and accept unsafe filesystem and privilege configurations. This change resolves the 25 audited findings and prepares v0.1.0, with a regression test or release gate mapped to every finding in the audit resolution matrix.

• Share child execution and synchronize PID 1 orphan reaping with managed waits; propagate condition cancellation and drain output safely.
• Handle macOS zombie groups and exit transitions without hiding signal permission errors for live processes; exercise 100 repeated cancellations in native tests.
• Validate filesystem paths and credentials before commands run; fix shared log rotation, retention, byte preservation, and output-error handling.
• Correct dependency gates, critical/noncritical failures, retry accounting, readiness, TLS startup, uptime concurrency, and status-port precedence.
• Require Go 1.26.7 and gate release publication on native Linux/macOS tests, isolated Docker tests, and pinned source/binary vulnerability scans.

Migration: stricter path/credential checks, nonzero exits for permanent failures, the context-aware custom-condition API, rejected sequential forward dependencies, and console chunking are documented in operations and the v0.1.0 changelog. The release:minor label selects v0.1.0 from v0.0.3; binaries embed the release tag through the existing build workflow.

Validation completed locally:

• go test -race -count=1 -cover ./... and go vet ./... passed.
• Four Python release-helper tests passed, including shell-injection payloads.
• Isolated Docker tests passed as actual PID 1: 3,584 short-lived children, nonzero exit preservation, descendant cleanup, cross-UID supervision, capability preflight, and unsafe filesystem paths.
• All four Linux/Darwin amd64/arm64 builds passed; govulncheck v1.8.0 found no vulnerabilities in source or binaries.
• PR CI passed for the final head: native Linux/macOS race tests and vet, Docker integration tests, Python release-helper tests, and source plus all four binary vulnerability scans. The release workflow repeats verification against the merge commit before publication.