feat: testing audit of dockerize (plan): find untested risky code

[jwilder]

Summary

Fix 7 findings from the Testing audit (testing v1) at d9fd48f, each in a small, easy-to-review step with a test. Make the test suite something to trust: risky code is covered, every test can fail, and the suite is fast and stable enough that people run it. Unticked findings stay in the backlog for a later run.

What changes

• Add test helpers that reset package globals and run log.Fatalf cases in a subprocess
• Stop waitForHTTP from using a nil request after NewRequest fails, and test its retry paths
• Test waitForDependencies timeout, unsupported scheme and unix socket paths
• Test parseConfigFromFlags, startCommand, startTailers and main's usage/version paths
• Test template error paths with subprocess cases
• Test tailFile on a file created later, a named pipe and poll mode
• Make the signal kill timeout injectable and test signal delivery and the kill fallback
• Address the pre-PR gate's round 1

Testing

Every step adds a test that fails before its fix (or shows the finding no longer reproduces) and runs the project's full existing test suite. A refactor step keeps behaviour, so the existing tests prove it.