SC-15: test suite, benchmarks, and CI/CD pipeline

[iampryce]

Real-rsync comparison tests (basic recursive, filtered, attribute preservation) - behavioral equivalence against real rsync's output, not wire-protocol interop (grsync's gob-based wire format was already established as incompatible with real rsync's, per SC-6/SC-9/SC-13/ SC-16). Skip gracefully without rsync on PATH.

6 fuzz targets across sync/daemon/transport, each checking one explicit invariant: checksum roll-vs-scratch equivalence, delta round-trip correctness, filter matcher never panics, greeting parser never panics, line reader respects its length cap, frame decoder never panics or over-allocates.

BenchmarkGenerateDelta (3 sizes x 4 change-percentages) and BenchmarkGenerateSignature.

CI: new test job (Linux+Windows matrix, -race on Linux only, real rsync installed on Linux only), new fuzz job (6 explicit 15s bursts), new vulncheck job.

Real findings:

• ci.yaml had build/lint jobs but no actual go test step at all - every test written across every prior ticket was only ever run locally, never enforced as a merge gate. Fixed.
• grsync has no trailing-slash sensitivity on source paths (src and src/ behave identically), unlike real rsync's well-known distinction
  • undocumented anywhere before this ticket's comparison tests surfaced it. Now disclosed in the README.
• Lint caught 3 unused-parameter findings in fuzz closures that only check 'never panics' - fixed via _, no suppressions.

Local environment (CGO_ENABLED=0, no gcc) can't compile -race here; enforcement happens on CI's Linux leg, same pattern as the already-established missing local rsync/govulncheck binaries.

Clean gofmt/build/vet/lint/test on native Windows and cross-compiled Linux.