Harden runtime boundaries and bound log dump

[m1ngsama]

Summary

• harden module child startup by closing inherited file descriptors, clearing loader injection environment variables, and applying conservative core/fd limits before exec
• make module shutdown escalate from SIGTERM to SIGKILL and reap the child process
• bound plain dump to the last 100 persisted records and add explicit dump --all
• persist interactive sends before broadcast/module publish, matching exec post
• set an explicit session thread stack size and tighten the systemd service sandbox
• update docs and regression tests for the changed exec surface

Closes #59.

Tests

• make
• make -C tests/unit run
• make script-test
• make integration-test PORT=13800
• make module-runtime-test PORT=13980
• make security-test PORT=14000
• make slow-client-test PORT=13920 DURATION=5 BURST_CHARS=1600
• make stress-test PORT=13940 CLIENTS=12 DURATION=10
• make soak-test PORT=13960 DURATION=8 RECONNECTS=5
• git diff --check

Note: make check was invoked, but cppcheck and clang-tidy are not installed in this local environment.