Fix security audit findings

[bsg62]

Summary

• Propagate final command failures while still cleaning up server process groups and descendants.
• Validate readiness URLs, disable redirect-following checks, and bound attempts/timeouts.
• Narrow dependency features, refresh vulnerable transitive dependencies, add cargo-audit CI, document trusted config behavior, and make tests self-contained.

Test Plan

• cargo fmt -- --check
• cargo clippy -- -D warnings
• cargo audit
• cargo test -- --test-threads=1
• cargo test