fix: harden runtime cancellation, reloads, and decoding

[renyijiu]

Summary

Runtime faults now fail safely instead of crashing the daemon, losing queued rule work, accepting partial configuration, reporting false readiness, or allocating directly from untrusted CDR lengths.

The important behavior change is end-to-end completion tracking: a listened file is marked processed only after every emitted rule item has completed synchronous ConsumeNext handling. Cancellation leaves unfinished files retryable, while permanently malformed individual MCAP/ROS1 messages remain best-effort skips so healthy messages are not replayed forever.

Safety guarantees

Area	Guarantee
File state	State and directory sets use one RWMutex; persistence and traversal operate on lock-protected snapshots.
Rule workers	Channel sends, semaphore waits, and file handlers observe cancellation; in-flight files are deduplicated and completion is acknowledged by the consumer.
Configuration	Loaders return errors, runtime reloads preserve the last complete configuration, and unavailable imports cannot overwrite it with a partial merge.
Master startup	Readiness is reported only after net.Listen succeeds; bind failures propagate to the command lifecycle so a later authorized status can retry.
CDR decoding	Array lengths are limited by remaining payload and a 64 MiB decode budget, with conservative complex-object accounting and explicit schema-bound errors.

Compatibility notes

• A declared local import file is now required at startup. Deployments that relied on an absent optional override must create it or remove the import before upgrading.
• A non-cancellation file or rule-consumption error moves the unchanged file to a terminal failed state. It becomes eligible again only after its size or nanosecond modification time changes; this prevents repeated, non-idempotent uploads.

Validation

• go test ./...
• go test -race ./cmd/coscout/commands ./internal/config ./internal/daemon ./internal/master ./internal/mod/rule/... ./pkg/mcap_ros2 -count=1
• go vet ./...
• git diff --check origin/main...HEAD

New concepts

Last-known-good configuration

A last-known-good reload keeps serving the most recent complete configuration when a new candidate cannot be fully read or parsed.

flowchart LR
    A["Load candidate"] --> B{"All declared inputs valid?"}
    B -- "yes" --> C["Replace last-known-good"]
    B -- "no" --> D["Return error + existing last-known-good"]

Loading

This is used here because runtime configuration spans a base file plus local and remote imports. Accepting only the pieces that happen to be available would silently change collection, upload, or rule behavior.

The startup loader seeds an explicit local baseline; only a complete runtime merge may replace it.

Do not use this pattern when stale configuration is more dangerous than downtime—for example, when a revoked security policy must take effect immediately.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}