IPv6 health checks, forward writer close, comment register

[CMGS]

Whole-repo read after v0.1.3: one bug fix, one behavior change the 09-03 round described and never made, and style. Four commits.

Bug

A TCP health check never passed for an IPv6 workload address. Probe joined the address as ip:port, so ::1:8080 reached the dialer, which rejects it. The oci hook falls back to the IPv6 address on a single-stack network, so a workload there with tcp_ports stayed unhealthy. Both the TCP and the HTTP address now go through net.JoinHostPort. Regression test: a listener on [::1]:0 with a TCP and an HTTP check; it failed before the fix.

Forward writer close

The writer waited five seconds between its context being cancelled and the close. stopForwarding removes the target before it releases the writer, so every later line finds no target and never reaches the writer. The wait protected one line: a forward that had its target in hand at that moment. That line now counts as a forward drop. c23d618 described this change; its diff never touched logs/.

TestWriterClosesOnceItsContextIsCancelled pins it (fails with the wait, passes without). TestNewWriters waits for its goroutines instead of sleeping seven seconds.

Style

• Interface godoc sits on the interface (SetNodeStatus, WorkloadExists), WritePid tags its Fatalf, the workload id fact is stated once, PullLog loses a for that never looped.
• Own-line comments start uppercase (28 lines). A comment that leads with a code identifier or a tool's own name keeps that case.

Hardware

Two bare-metal hosts (Debian 13, kernel 6.12, systemd 257), one agent per host as its own node, both reporting to one core (master dde58633, embedded etcd). Three process workloads per host, each a python3 -m http.server unit with a TCP and an HTTP check in its meta file, on 127.0.0.1, on ::1 and on the host's global IPv6 address. Arms interleaved base, PR, base, PR; base is master 95d8bbb, PR is b6b58d3. The meta files and units were written by hand in the shape core's process engine writes them, so core held no workload record for them.

Per 38 s window, both hosts, both rounds	base 95d8bbb	PR b6b58d3
127.0.0.1 workload: probes failed / HTTP GETs served	0 of 4 / 4	0 of 4 / 4-5
::1 workload: probes failed / HTTP GETs served	4 of 4 / 0	0 of 4 / 5
global IPv6 workload: probes failed / HTTP GETs served	4 of 4 / 0	0 of 4 / 5
agent error lines	8	0
forward writer closes after the last workload stops	4.975-4.978 s	inside the stop itself (about 0.12 s after it began)

On base the TCP probe fails with too many colons in address and the HTTP probe with invalid port ... after host, so both checks were broken for an IPv6 address, not only the TCP one. Both nodes stayed available in core for the whole round, and core logged no error.

Forwarded lines reached the sink at the same rate in both arms: 3 per workload per window.

Not in this PR

The systemd MainPID fan-out and the concurrent Multi.List stay. A cut keeps the results and slows the listing. Measured on the same two hosts with one test binary that holds both shapes (60 rounds, arms interleaved, order swapped each round, every workload needing the MainPID lookup; the two hosts agree within 1 ms):

List p50	10 workloads	50 workloads	200 workloads
systemd, fan-out (current)	0.78 ms	3.0 ms	13 ms
systemd, sequential	1.33 ms	6.0 ms	29 ms
systemd + cocoon, concurrent (current)	0.83 ms	3.2 ms	13.5 ms
systemd + cocoon, sequential	1.0 ms	3.9 ms	16.7 ms

The cocoon runtime had no daemon and no VM here, so its list is a directory read; a node whose second runtime is containerd was not measured.

Evidence

GOWORK=off: make lint 0 issues on linux and darwin, make fmt-check, asl ./... on both, go test -race -count=1 ./... all pass. Comments: +2/-4 across the PR.

Release note: #142 needs a core release that carries core #757, so this ships after core.