release(1.4.0): the websocket guard, the status route and the adapter lifecycle surface - floor guard-core-go v4.3.2

[rennf93]

Release PR for echo-guard v1.4.0 (the Go family 1.4.0 wave; the tag IS the release for a Go module).

What ships

• The websocket handshake guard (feat(echo): the websocket handshake guard #26): GuardWebSocket(engine, c) over the upgrade request, WebSocketHTTPStatus (503/403), the ws request shim mirroring _WebSocketGuardRequest.
• The reference status route (feat(echo): the status route #27): AddStatusRoute(e, engine, path) serving the engine initialization snapshot JSON at /_guard/status.
• The adapter lifecycle surface (feat(echo): the adapter lifecycle surface #28): MarkInitialized, GetInitializationStatus, Reset, AgentStats, RefreshCloudIPRanges over the engine handle.
• Engine floor to v4.3.2: ReDoS static safety (pattern_safety registry-free 94/94), sus-patterns runtime registry, custom_response_modifier (Engine.ModifyResponse), the engine websocket guard with shared suspicious counts, the fifteen SecurityConfig knobs + performance-monitor wiring, the lifecycle/state surface; go-redis v9.23.0 / x/sys v0.48.0 transitively.
• x/net v0.60.0 explicit indirect floor (cda0754): clears GO-2026-6603/6610/6611/6612/6617 http2 findings reachable through the cloud-refresh lifecycle.
• Post-transfer metadata: Guard-Core org repoint including the upstream-drift checkout; module paths unchanged.

Gates

• gofmt -l . clean; go vet ./... clean; staticcheck ./... clean; go build ./... ok
• go test ./... green; REDIS_HOST=127.0.0.1 go test -tags integration ./... green
• Coverage gate: 100%

No tags in this PR; the v1.4.0 tag is cut on the squash-merge commit after merge.