Fix 8 bugs: TOCTOU races, panics, and missed cases from PR #150

[cep21]

Summary

Follow-up to #150 — 8 additional bugs found across the same areas. All fixes are backwards-compatible (panic→works or panic→error; no behavior changes for existing valid usage).

Fixes

#	Bug	File	Fix
1	ConsecutiveErrOpenerFactory config race	closers/simplelogic/closers.go	Copy config before Merge (same pattern as #150 for hystrix factories)
2	openCircuit can emit Opened() 2-3× under concurrent calls	circuit.go	CompareAndSwap before emitting metric
3	close can emit Closed() multiple times	circuit.go	CompareAndSwap before emitting metric
4	Opener.SetConfigNotThreadSafe nil-deref on props.Now	closers/hystrix/opener.go	Use nil-safe props.now() helper (already existed at line 53)
5	RollingCounter.GetBuckets/.String() divide-by-zero on zero value	faststats/rolling_counter.go	Guard NumBuckets == 0
6	RollingCounter.UnmarshalJSON nil-deref on incomplete JSON	faststats/rolling_counter.go	Return error on missing required fields (panic→error)
7	Fallback MaxConcurrentRequests double-read	circuit.go	Read once into local (same pattern as #150 for main throttle)
8	MockClock.AfterFunc — negative duration doesn't fire immediately	internal/clock/clock.go	d == 0 → d <= 0 (matches real time.AfterFunc)

Backwards compatibility

• CAS in open/close — Opened()/Closed() now fire after isOpen is set (previously before). Audited all in-repo Metrics implementations — none call IsOpen() from inside the callback. The old ordering was non-deterministic under the TOCTOU anyway.
• UnmarshalJSON — incomplete JSON (e.g. {}) now returns an error instead of panicking. Round-trip (Marshal→Unmarshal) is unaffected and fully covered by new tests.
• GetBuckets — returns nil for zero-value counter instead of panicking. range nil is a no-op so callers are safe.

Test coverage

Every fix has a regression test:

• TestOpenCircuit_EmitsOpenedExactlyOnce / TestCloseCircuit_EmitsClosedExactlyOnce — 100 concurrent goroutines
• TestConsecutiveErrOpenerFactory_ConcurrentCreation — 100 concurrent factory calls under -race
• TestOpener_SetConfigNotThreadSafe_NilNow — direct call without Now set
• TestRollingCounter_Empty — extended for zero-value GetBuckets/String
• TestRollingCounter_UnmarshalJSON_IncompleteInput — 5 partial-JSON variants × 2 receiver states
• TestRollingCounter_UnmarshalJSON_RoundTrip — key BC test: 3 counter states marshal→unmarshal cleanly
• TestMockClock_AfterFunc — extended for negative duration

Verification

go test -race -count=10 ./...   # all pass
go vet ./...                    # clean
golangci-lint run ./...         # 0 issues