test: rewrite unit tests with testify/goleak; coverage 100% (#10) #6

Job	Run time
No AI attribution	4s
Makefile targets documented	3s
Security scan	32s
Lint	1m 23s
Build darwin/arm64	16s
GoReleaser config check	15s
No local paths or replace directives	4s
Build windows/amd64	18s
Test (ubuntu-latest)	37s
Apache 2.0 header on every Go file	4s
Build linux/amd64	16s
Test (macos-latest)	42s
	4m 34s

Provide feedback