Harden provider startup handshake protocol

[writeameer]

Summary

• Process-exit detection: waitForReady now races 3 signals (modeled after Terraform's go-plugin): first stdout line, process exit, and timeout. Previously a crashed provider would block for the full 30s timeout.
• Stderr capture: Provider stderr is captured via io.MultiWriter during startup and included in error messages, so crash diagnostics are immediately visible.
• 10 unit tests covering handshake and post-handshake failure scenarios
• CI workflow added to run tests on push/PR to main
• Removed accidentally committed dstream binary artifact

Test cases

Test	Scenario
ProviderSendsReady	Happy path — provider emits {"status":"ready"}
ProviderSendsError	Validation failure — provider emits error signal
ProviderCrashes	Process exits before handshake — detected instantly, not after 30s
ProviderHangs_TimesOut	No response — times out at configured duration
LegacyProvider	No handshake — backward compatible, first line treated as data
CrashWithStderrContext	Crash with stderr — last 10 lines included in error
ProviderCrashMidStream	Provider dies during data flow — broken pipe detected
ProviderEchoRelay	Data relay works correctly after handshake
GracefulShutdownOnStdinClose	Provider exits cleanly when stdin closes
ProviderStderrDuringNormalOperation	Stderr logging doesn't interfere with data

Closes #24, closes #25, closes #26

Test plan

• All 10 tests pass locally
• CI workflow runs on this PR and passes

🤖 Generated with Claude Code