Improve panics and tests

[Vladyslav-Kuksiuk]

This PR:

• Replaces panic-based partition bounds checks. Resolves issue.
• Guards IsContentChanged against short generated results. Resolves issue.
• Replaces legacy x/net/context in logging. Resolves issue.
• Adds direct tests for main-mode aggregation and output. Resolves issue.

[Oleg-Melnik]

@claude review

[Oleg-Melnik]

@codex[agent] review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 01427e0656

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Oleg-Melnik]

Review by Claude

LGTM — nothing blocking found.

Checked and confirmed clean:

• IsContentChanged guard: len(c.Result) < c.lineIndex is exactly the panic condition from Guard IsContentChanged against short generated results #86; the loop bounds on c.source stay safe since lineIndex ≤ len(source) by construction.
• Partition.Select: check order is right (start → end < 0 sentinel → inverted → end bounds). The endPosition < startPosition-1 boundary deliberately preserves the old behavior of allowing empty partitions (end == start-1 → empty slice), matching adjacent #docfragment/#enddocfragment markers. The old code genuinely panicked on inverted bounds; now it's a proper error.
• hasLineIndex replacing the recover()-based safeAccess is strictly better — the old version also handled negative indexes inconsistently.
• No remaining x/net imports anywhere in the repo; the go.mod // indirect demotion is correct.
• captureStdout: pipe lifecycle, reader goroutine, and the closed flag handle both the success and Ginkgo-failure (panic) paths without leaking or double-closing; the 128 KiB test covers the pipe-buffer case.
• New main tests match actual main.go behavior (singular/plural headings, errors.Join aggregation, empty output on the embed error path).

Two non-blocking notes:

1. The closed-flag dance in captureStdout could be simplified by doing all cleanup only in the deferred function.
2. IsContentChanged still can't detect a pure-append divergence (Result strictly longer with an identical prefix) — pre-existing and likely unreachable through the parser, so informational only.

[Oleg-Melnik]

@Vladyslav-Kuksiuk LGTM with minor comments from Claude.