fix: harden runtime lifecycle and input handling

[h3zh1]

Summary

• linearize TCP, HTTP, REM, global listener, and Forward lifecycle operations, including failed runtime
  replacement and bounded REM shutdown
• enforce a single active Forward task stream and roll back uncommitted resources on bind, cmux, backpressure,
  and concurrent close failures
• harden untrusted Malefic input with encoded and decoded size limits, Snappy validation before allocation, and
  bounded initial and payload reads
• synchronize shared client and Session runtime state, including sysinfo snapshots and atomic keypair updates
• make event subscription, startup replay, and stream shutdown explicit and atomic, with an acknowledged
  subscription barrier
• remove the unused RequestAndWait path and wait for Forward Listener shutdown
• restore artifact website publishing through the supported raw-content path while preserving format, RDI,
  metadata, and default path handling
• expand concurrency, fuzz, lifecycle, and integration coverage and align GitHub Actions with Go 1.25

Validation

• go vet ./...
• go test ./... -count=1 -timeout 300s
• CGO_ENABLED=0 go build ./...
• CI-equivalent race tests for core, parser, and stream
• full client/server integration package selection
• repeated parser, lifecycle, backpressure, rollback, cache, subscription barrier, and Forward Listener tests
• independent reviewer approval