ci(soak): validate dispatch inputs, time out each iteration, compile once

[deadpoets]

The two INFO findings in the soak workflow — both in code written during this
session, both worth fixing on their own merits.

1. Dispatch inputs reached a bash arithmetic context — :86

((i <= ITERATIONS)) is a code-execution sink. Bash evaluates array subscripts
inside arithmetic, so ITERATIONS='a[$(cmd)]' runs the substitution.

Demonstrated, not asserted:

=== demonstrate the sink (old, unvalidated arithmetic) ===
  INJECTION EXECUTED — marker written: pwned

Passing the inputs through env: rather than interpolating ${{ }} into the
script already closed the YAML-level injection. This closes the arithmetic one,
which is the half that remained.

Dispatching needs write access, so this is hardening rather than a hole a
stranger can reach — but a workflow in a security repo should not evaluate its
own inputs.

iterations, gomaxprocs, mode and the new timeout are validated before
use:

  input='a[$(printf pwned > …)]'   rejected
  input='200'                      ACCEPTED
  input='0' '99999' '' '12abc' '-5'  rejected
  marker absent — validation did not evaluate the payload

2. A hang produced zero evidence; a compile error produced N false ones — :87

No per-iteration timeout. A hang meant the job sat until its own 90-minute
limit and was killed with no traceback. After a crash, a deadlock is the second
most interesting outcome — and it was precisely the one this workflow could not
report. Each iteration now carries -timeout / -test.timeout, so a hang panics
and dumps every goroutine, which with GOTRACEBACK=system is exactly the
evidence wanted.

Compilation was inside the loop. A compile error failed all N iterations
identically and reported them as N crashes — a wall of false positives burying
the rare real one, and a failures: 200 line meaning the opposite of what it
appeared to. It now compiles once and fails fast.

Failure classification

The number this workflow exists to produce is a rate for one phenomenon, so
failures are now bucketed runtime-crash / data-race / hang /
test-failure rather than totalled together.

Patterns were checked against real output rather than guessed:

Input	Classified
fatal error: stack not a power of 2 (sighting 1)	runtime-crash
fatal error: acquireSudog: found s.elem != nil (sighting 2)	runtime-crash
real go test -timeout panic	hang
ordinary t.Fatal	test-failure
WARNING: DATA RACE	data-race

A race report gets its own bucket because -race finding a genuine write race
would be the best lead available on a bug whose entire signature is a stray
write — it must not be filed beside a flaky assertion.

Validated: bash syntax over the extracted 148-line script, YAML parsed, and the
injection/validation behaviour exercised directly.