fix: correctness defects from codebase audit (signal race, archive cleanup, rsync capture)

[jkleinne]

Summary

Three moderate correctness defects surfaced by a codebase audit, each its own revertible commit.

• A signal during a run shared a plain bool between the handler goroutine and run() with no synchronization, a data race when a natural exit and a signal collided. Signal handling now derives the outcome from signal.NotifyContext, and a companion goroutine restores the default disposition so a second SIGINT terminates immediately instead of being swallowed. The exit-130 contract is unchanged and now covered by a -race subprocess test for both SIGINT and SIGTERM.
• CleanupArchives reported every rclone lsd failure as "no archive directory (nothing to clean)" and returned nil on every path, so a misconfigured remote silently skipped retention and the runner's warn branch was dead code. Listing failures are now classified (rclone exit 3 stays the benign first-run case; anything else returns a wrapped error the runner surfaces) and purge eligibility moved to a pure time.Parse-validated predicate that rejects calendar-invalid names like 0000-13-45 the old positional check accepted. Unrecognized directory names are warned and never purged.
• The rsync executor buffered all of stdout in memory; with the example config's -v flag that grows with file count. Capture now goes through a bounded 64 KiB tail writer, leaving the stats parser and fixtures untouched (rsync prints the stats block last, so it always survives in the tail).

Coverage added alongside the fixes: the archiveDirExpired predicate table, tailBuffer boundary cases, firstStderrLine units, and the signal exit-code tests. Full suite passes under -race; golangci-lint --new-from-merge-base reports no new issues.