Fix data races, credential leaks, and correctness issues

[shawnburke]

Summary

• Data races fixed: Add sync.RWMutex to RegistrationReflector.targets map and handlerManager maps to prevent concurrent map panics. Use atomic.Bool for Supervisor.killed/done flags.
• Credential leaks fixed: Mask tokens in debug logs (show first 4 + last 4 chars). Remove SNYKBROKER_ env var values from log output.
• Correctness fixes: Remove double WriteHeader calls in reflector and handleSystemCheck. Fix handleReregister to check Restart() error and write response. Convert two panic() calls in relay_instance_manager to returned errors. Guard Print() against short API tokens. Fix signal handler goroutine leak in Supervisor. Sanitize handler names in history file paths with filepath.Base().

Issues addressed

#	Issue	Severity
1	targets map data race in RegistrationReflector	P0
2	killed/done data races in Supervisor	P0
5	Token logged in plaintext at Debug level	P0
3	Double WriteHeader in reflector ServeHTTP	P1
4	Double WriteHeader in handleSystemCheck	P1
6	Panic on short API token in Print()	P1
7	handleReregister ignores Restart() error	P1
14	Signal handler goroutine leak in Supervisor	P1
8	panic() → returned errors in relay instance manager	P2
10	SNYKBROKER_ env vars logged with values	P2
12	History file handler name not sanitized	P2
13	No concurrency protection on handlerManager maps	P2

Test plan

• go build ./... passes
• go vet ./... passes
• go test ./... passes (all packages)
• CI green

🤖 Generated with Claude Code