chore: bring the gate up to the standard of the sibling packages

[sylvesterdamgaard]

CI ran tests, a race pass and golangci-lint, and nothing else. It reported no
vulnerable dependencies, no licence problems and no formatting drift — because
it never looked for any of them.

The gate

Ported from cboxdk/fpm-exporter, where these were built last week:

• govulncheck
• A deterministic CycloneDX 1.5 SBOM. cyclonedx-gomod records the
  pseudo-version of HEAD, tags purls with the generating host's goos/goarch
  and embeds hashes of its own binary — so a laptop and a runner could never
  agree. tools/sbomnorm normalises all three; the committed file changes only
  when dependencies do.
• A dependency licence check reading that SBOM rather than the network, so
  CI and offline give the same answer. 63 dependencies, all permissive, no
  exceptions needed (fpm-exporter needs one, for gopsutil's MPL-2.0
  Apple-Silicon helper; nothing here does).
• gofmt and go mod tidy drift checks. 26 files were not gofmt-clean.
• make check, running the identical set locally.

Linters

bodyclose, errorlint and misspell — added one at a time after fixing what
each surfaced, which is what this repo's own .golangci.yml says to do. Seven
findings, three real:

• handleExecutionError type-asserted on the error instead of errors.As
• two ==/!= comparisons against sentinel errors

Four are documented as deliberate rather than changed. Three are in the snapshot
client, where the existing comment explains that the cause is joined with %v
on purpose: wrapping it with %w would make it matchable and defeat the design
that callers test for ErrUnavailable and nothing else. The fourth is a
bodyclose false positive where the response body is the stream and is closed
by the reader goroutine.

Branding

The PHPeek name survived the rebrand in six places, two of them user-visible:
the TUI header, its keyboard-shortcut screen, the audit log's start and shutdown
records, the build-info metric's help text, and a config warning.

Scale-to-zero was treated as untouchable

Across internal/snapshot, internal/process and internal/autotune there is
exactly one production line changed:

-if err == syscall.ECHILD {
+if errors.Is(err, syscall.ECHILD) {

Equivalent for the bare errno Wait4 returns, and correct if it is ever
wrapped. Everything else in those packages is comments and test formatting.
go test -race passes over both internal/snapshot and internal/process in
full, not just -short.

Note on govulncheck's first run

It reports seven standard-library advisories against a local Go 1.26.4. All
are fixed in 1.26.6, and CI pins '1.26', which resolves to the latest patch —
so released binaries are unaffected. Worth knowing that the answer was simply
never being asked before.