fix: harden spec validation and field-path evaluation

[machado144]

Summary

Addresses silent-failure and trust-break issues in the core assertion
engine, so invalid tests error out instead of passing. All existing
fixtures still pass; 16 new tests lock in the new behavior.

Correctness fixes

• Strict YAML decoding + spec validation — KnownFields(true) plus a
  validateSpec step means typos like toEquals: now fail parse
  instead of silently passing. Also rejects empty describes, missing
  should/expect, and assertions with zero operators.
• Real multi-doc YAML parsing — ParseManifests uses yaml.Decoder
  instead of strings.Split("---"), so a literal block that happens to
  contain --- no longer creates phantom documents.
• Missing vs null distinction — extractFieldValues probes the
  parent object with has() to tell "present but null" from "missing".
  Fixes both toExist (now passes for an explicitly-null field) and
  toBeNull (now fails for a missing field, as it should).
• [*] wildcard checks all results — previously only the first
  value from a wildcard path was evaluated; now the operator runs
  against every produced value, matching the documented semantics.

Ergonomics

• Reject --fail-fast with --workers > 1 — the parallel path
  silently ignored fail-fast before; now it errors clearly.
• --pre-run-timeout flag (default 60s) — wraps each pre_run
  command in context.WithTimeout, preventing indefinite hangs.
• Sorted list --tags output — deterministic alphabetical order.

Incidental

• Bumped go 1.25.0 → go 1.25.8 in go.mod to pick up the stdlib
  os fix (GO-2026-4602).

Test plan

• make test — 118 tests pass (82 unit, 36 integration)
• go vet ./... clean
• gofmt -l . clean
• govulncheck ./... — no vulns in our code
• Pre-commit hooks green (gofmt, structlint, govet, golangci-lint)

New tests added:

• Unit: unknown operator, missing operator, missing should/expect,
  empty describe, toExist/toBeNull as sole operators, null-vs-missing,
  wildcard-checks-all, literal block with ---
• Integration: fail-fast+workers rejection, pre-run-timeout, tags-sorted

🤖 Generated with Claude Code