[DevCop95]

Four fixes that came out of deploying the console locally and driving the whole
route table over raw sockets (29 routes: Host/Origin/token/flag permutations,
WS handshake, a live broadcast frame, the packer, headless audit). Everything
here is a finding that only shows up with the service actually running — the
unit tests were green the whole time.

Relates to #6, which records the two findings from the same pass that are design
decisions rather than bugs, and are deliberately not in this PR.

persist: the child processes had no deadline

schtasks /Query and the WMI PowerShell query ran under exec.Command, which
waits with no deadline. The Task Scheduler and RPCSS are famous for wedging, and
when they do, the HTTP handler holds its goroutine until they come back: a
request that never answers instead of an error. Measured on a stock workstation,
a full List() takes ~5.5s, so the budget is 20s — a liveness bound, not a
latency target.

WaitDelay matters as much as the deadline here: killing cmd /c … or
powershell does not kill what they spawned, and the inherited pipe stays open
until that grandchild exits, so the context alone would still block on the read.

The test has teeth. With the context removed it fails at 9.09s
(the context was not enforced); with it, 0.45s. timeout /t cannot be the
sleep — it refuses to run without a console, which is exactly how runHidden
spawns its children — so it is a real ping -n 10.

server: the comment described a belt that is not there

validHost claimed the stdlib HTTP server rejects malformed Host shapes
before a handler sees them. Driving the live listener showed that is true for
127.0.0.1:8080/evil (400, never reaches us) and false for
127.0.0.1:8a08 and 127.0.0.1: — both reach the handler and are refused by
isPort alone:

Host: 127.0.0.1:8a08  -> 403 forbidden: host   <- refused by isPort
Host: 127.0.0.1:      -> 403 forbidden: host   <- refused by isPort
Host: 127.0.0.1:8080/evil -> 400               <- refused by the stdlib

Still not a bypass — a rebinding page supplies its own hostname, it cannot make
the browser send a loopback one — but for those two shapes the strict check is
the only control, not a hardening layer over the stdlib, and the comment now
says so.

cmd: the version was older than anything published

A source build reported 2.0.1 while main is past the 2.0.2 release, so
--audit --json and every bug report carried a version older than the published
one. Bumped, with a note that it tracks the newest tag.

oblpack had no -version at all. Fine for go run, not fine for a binary
that ships in the archives — so it gained one, and it is stamped in
.goreleaser.yml like the console is. A shipped binary that invents its own
version is worse than one that admits it does not know it.

Verification

gofmt                                        clean
go vet ./... && GOOS=linux go vet ./...      clean
staticcheck ./...                            clean
go test ./... -count=1                       11/11 packages, 0 FAIL
coverage                                     45.3% (floor 43)
gosec -exclude=G103,G104                     files=37 lines=7298 nosec=47 found=0
gosec type-error gate                        no unexpected entry
build (windows/amd64)                        both binaries link
-ldflags -X main.version=v9.9.9-test         stamps BOTH binaries

The last line is the one worth repeating: oblpack and obliteratus both
report the injected value, so the goreleaser stamp added here is proven rather
than assumed.