test: tighten listener, route-table and integration assertions (#55)

[abienkowski]

Description

Part of #55 (Task 5 of the plan: the test-quality items). Tests only; no product code changes except a type-only tightening of the TS flag lists.

What changes

• Go listener tests (go/main_test.go):
  • TestLockReleasedOnSIGKILL registers t.Cleanup to kill and reap its child right after cmd.Start(), so a failing assertion no longer leaks the process; the manual kill/wait pairs are gone.
  • The concurrency losers assert the exact message <path> is in use by another instance (lock <path>.lock held), as Rust does, instead of a substring.
• EPERM skips, all three: the chown-EPERM tests also skip when the effective gid is 0 ("process's own group is gid 0, so chown to it succeeds"), where the chown would succeed.
• Route tables (Rust, TS): the five older table-driven route tests collect every mismatching row and assert once, like the Deferred minor findings from the #43/#47/#50/#51 review cycles #55 empty-segment table. Rows and test counts are unchanged.
• TS flags: VALUE_FLAGS and BOOL_FLAGS are Object.freeze([...] as const), and validateFlags takes readonly string[]. No behaviour change.
• Integration deny bodies (deploy/test.sh): a new check_denied helper passes only on a 403 whose body contains the proxy's deny message. All 28 checks expecting 403 use it, so a 403 from the daemon, or a different proxy deny, can no longer pass. Each request helper truncates the body file first, so a check can't pass on the previous body. The absolute-form check accepts either proxy message (Go and Rust deny it as exec is not allowed, TS as empty path segment not allowed). A mislabelled check (PATCH /containers/test, which sends POST) is relabelled POST /containers/test -> 403 (no action segment).

Review notes

• Release: merging cuts v0.3.6 (patch, test: commits). Simulated squash: bump=patch tag=v0.3.6.
• Rust gate denials are not prefixed with validation failed: as in Go and TS; the checks match the gate's own message, which all three share. Not changed here.

Verification

• make test-all: Go 109, Rust 147 passed, TS 164 tests, 0 fail, 1 skipped (unchanged).
• make lint-all passes.
• Integration: Go, Rust and TS each ALL 45 TESTS PASSED.
• Mutation: pointing the /build check at the wrong message fails it: FAIL: POST /build -> 403 (expected 403 with "commit is not allowed", got 403: build is not allowed). Reverted.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Tests only

Implementation(s) changed

• Go (tests)
• Rust (tests)
• TypeScript (tests; flag list types)
• Quint specification
• CI / infrastructure

Testing

• Unit tests pass (make test-all)
• Integration tests pass (45 per implementation)
• Quint verification: not affected
• New assertions added

Checklist

• I have read CONTRIBUTING.md
• My code follows the project's coding style
• I have updated documentation as needed