chore: simplify and modernize for Go 1.27

[dunglas]

Follow-up to the Go 1.27 upgrade in a411024, applying what the new release makes available.

Modernizers

go fix gained slicesbackward, embedlit and unsafefuncs, and renamed waitgroup to waitgroupgo. Applied across both modules, with two exceptions:

• The extgen parsers are left alone: embedlit rewrites their composite literals into a shape that reads worse than the original.
• go fix skips files that import "C", so the root package never got the transformations applied everywhere else. Those are done by hand in a separate commit.

Standard library

• splitRemoteAddr uses strings.CutLast, new in 1.27. Its not-found return is exactly what the old else branch assigned, so the branch disappears.
• The manual unsafe.Pointer/uintptr arithmetic in types.go and frankenphp.go becomes unsafe.Add. The old form is only valid inside a single expression and silently breaks if a later refactor splits the line.
• errors.As becomes errors.AsType, dropping the throwaway target values.
• Eleven copies of the register-or-panic block in metrics.go collapse into one mustRegister helper.

Tests

internal/state moves to testing/synctest. synctest.Wait returns once every subscriber goroutine is durably blocked, so the subscriber count is exact rather than polled for up to a second. This also makes the WaitForStateWithTimeout give-up path worth covering, since the bubble's fake clock fires its one second timeout instantly.

The other timing tests stay as they are. regularRequestChan is a package global that live PHP thread goroutines receive from, so a bubbled sender can have its send stolen by an out-of-bubble thread, and PHP threads are C threads, which never count as durably blocked. Bubbling them would buy flakiness, not determinism.

A new test uses the goroutineleak profile, GA in 1.27, to catch a thread, scaling ticker or watcher goroutine that outlives Shutdown with nothing left to wake it. Currently reports zero leaks across a full Init/Shutdown cycle.

/debug/pprof/goroutineleak needs no code to expose: net/http/pprof.Index dispatches profiles by name, so it is already live on the admin endpoint. Verified against a running server. It reports one leaked goroutine there, but the same one appears with no php_server configured at all, so it is Caddy/runtime baseline rather than ours.

Drive-by

internal/state had a bare import "C" with no C preamble and no calls into C, which forced a pure Go package through cgo. Removed.

No action needed

encoding/json/v2 backing encoding/json and the size-specialized allocator are both in the 1.27 baseline and active automatically. The stricter jsonv2 defaults ship only with an explicit encoding/json/v2 import, so v1 semantics are unchanged: duplicate keys still accepted, invalid UTF-8 still replaced rather than rejected.