fix: address all High and Medium follow-up review items

[c4po]

Bundles the remaining High and Medium items from the latest review, plus the README typos and Go-version bump.

High

• H-A getTerraformVersionConstraints no longer fails on parse errors in parent directories. A broken .tf in ~/scratch/foo previously bricked the wrapper everywhere under ~; now only the user's actual cwd is a hard failure, ancestors get logged and walked past.

Medium

• M-A Forward SIGHUP/SIGQUIT on Unix via a build-tagged forwardedSignals slice — without SIGHUP, a closing terminal would orphan the child terraform process.
• M-B Return 128 + signum when the child is killed by a signal (shell/terraform convention), instead of -1 from exec.ExitError.ExitCode(). Implemented as a build-tagged exitCodeFromError so Windows stays portable.
• M-C zip.NewReader now reads size from zipFile.Stat(), not response.ContentLength (which is -1 for chunked responses).
• M-D If os.Chmod fails after atomic.WriteFile succeeds, the partial file is removed so the next invocation re-downloads instead of forever cache-hitting a non-executable binary.
• M-E Per-binary flock around the download path serializes concurrent invocations so they don't both re-download the same archive. Uses github.com/gofrs/flock.
• M-F New TF_DEMUX_CACHE_HOME env var explicitly overrides the cache directory. os.UserCacheDir() ignores XDG_CACHE_HOME on macOS, so the integration suite has been writing into the real user cache; test.sh now sets TF_DEMUX_CACHE_HOME instead.
• M-G Strip TF_DEMUX_* env vars before exec'ing terraform. Otherwise a one-shot TF_DEMUX_ALLOW_STATE_COMMANDS=true would silently extend through any nested terraform-demux invocation.
• M-H Cache the parsed release index locally with a 5-minute TTL so rapid-fire invocations (shell completion, scripts) don't each pay an HTTP round-trip.

Polish

• L-D Bump go.mod's go directive and both workflows' go-version to 1.24 (1.21 is past EOL).
• L-F README typos: Compatability→Compatibility, recomment→recommend (x3), and the three instead \terraform state mv` commandbullets reworded to active voice withof` inserted where the verb was missing.

Tests added

• TestGetTerraformVersionConstraints_TolerantOfParentParseErrors — covers H-A regression.
• TestFilterDemuxEnv_StripsTFDemuxKeys — covers M-G.
• TestEnsureCacheDirectory_HonorsOverrideEnv — covers M-F.
• TestListReleases_UsesLocalIndexTTL — covers M-H by closing the upstream test server between two calls and asserting the second one still succeeds.

Test plan

• go test ./... clean
• gofmt -l . clean
• go vet ./... exit 0
• Cross-platform build: GOOS=windows go build ./... clean
• End-to-end smoke: `TF_DEMUX_ARCH=amd64 go run ./cmd/... -- -version` resolves correctly under testdata/terraform-pessimistic/

[Copilot]

Pull request overview

This PR bundles follow-up items from the latest review by improving wrapper robustness (constraint parsing, signal/exit-code behavior, env isolation), strengthening and de-duplicating release download/caching logic, and updating docs/tests/CI to match the new behavior.

Changes:

• Wrapper: tolerate parent-directory .tf parse errors, forward additional Unix signals, map signaled exits to 128+signum, and strip TF_DEMUX_* env vars before exec’ing Terraform.
• Release client: add a 5-minute local TTL cache for the parsed index, fix zip size handling, remove partially-installed binaries on chmod failure, and serialize downloads with per-binary flock.
• Tooling/polish: add targeted regression tests, introduce buffered logging helper, update README/test script, and bump Go version in module/workflows.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test.sh	Uses TF_DEMUX_CACHE_HOME for integration tests to avoid macOS cache pollution.
README.md	Fixes typos and documents TF_DEMUX_CACHE_HOME cache override.
internal/wrapper/wrapper.go	Implements cache override, tolerant constraint loading, signal forwarding via build tags, exit-code normalization, and env filtering.
internal/wrapper/wrapper_test.go	Adds regression coverage for tolerant parent parse errors, env filtering, and cache override.
internal/wrapper/signals_unix.go	Adds SIGHUP/SIGQUIT forwarding on Unix.
internal/wrapper/signals_windows.go	Defines Windows signal-forwarding set.
internal/wrapper/exitcode_unix.go	Returns 128+signum when Terraform is killed by a signal.
internal/wrapper/exitcode_windows.go	Keeps Windows exit-code behavior portable.
internal/wrapper/checkargs.go	Moves state-command version constraints to package-level pre-parsed constants.
internal/wrapper/checkargs_test.go	Updates tests to reuse shared mustVersion helper.
internal/wrapper/logging.go	Introduces SetupLogging to buffer logs until flushed on error.
internal/wrapper/logging_test.go	Adds tests for buffered vs verbose logging behavior.
internal/releaseapi/client.go	Adds local index TTL caching, build selection helper, zip size fix, chmod cleanup, and per-binary download lock.
internal/releaseapi/client_test.go	Refactors server fixtures and adds TTL cache test.
cmd/terraform-demux/main.go	Switches to wrapper.SetupLogging and uses flush-on-error flow.
go.mod	Bumps Go directive and adds gofrs/flock.
go.sum	Updates sums for newly added/updated dependencies.
.goreleaser.yaml	Injects release tag into main.version via ldflags.
.github/workflows/release.yaml	Bumps Go version for release workflow.
.github/workflows/ci.yaml	Expands unit test OS matrix and bumps Go version; adds integration job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.