fix: address linter findings and harden runtime correctness

[sgaunet]

• processor: drop leaked cancel in WithContext (gosec G118); route
  cancellation through stopCh/parentDone and close readers in Stop()
• executor: convert isStarted/isFinished to atomic.Bool; treat
  exec.ErrWaitDelay and context.Canceled-with-ProcessState as non-failures
• executor: validate raw command path before filepath.Clean to catch
  /../etc/passwd-style traversal that Clean silently normalizes away
• main: install signal handlers before exec.Start() to avoid orphaning
  the child; bound shutdown with killTimeout; derive signal exit codes
  from signalExitCodeBase+sig and surface non-exit errors as 1
• filter: pass lines with no detected level so plain output is no longer
  silently dropped by include/exclude level rules
• formatter: getColorCode returns (string, error) and rejects unknown
  color names; templateReferencesLine recognizes {{- .Line trim syntax
• config: skip filter validation when disabled; dedupe include/exclude
  pattern checks via validateFilterPatterns
• tests: add goleak TestMain to every package; pin Go via
  go-version-file in linter workflow; add go.uber.org/goleak v1.3.0

Closes #87