fix: stop dropping Ctrl-C during interactive login, and let CI see it

[leggetter]

Found while reviewing #378 - unrelated to that change, and already present on main.

The bug

protectTerminalState puts the terminal into raw mode for the login prompt and restores it from a goroutine when the user interrupts. The channel was unbuffered:

signalChan := make(chan os.Signal)
signal.Notify(signalChan, os.Interrupt)

signal.Notify never blocks - it does a non-blocking send and drops the signal if nobody is receiving. The goroutine starts immediately after, but a Ctrl-C landing in that window is discarded, and the terminal stays in the state the prompt put it in: no echo, until the user runs reset.

Note: this is already fixed on release/v3.0.0

It landed incidentally inside f2de696 ("fix(mcp): do not sign the user out when a reauth is never completed") and never made it back to main, so the 2.x line still has it. The change here is byte-identical to the v3 version, comment included, so the two converge rather than conflict when the branches meet.

Why CI missed it

go test runs a reduced vet suite - printf, bools, atomic and a handful more - and only over the packages under test. sigchanyzer is not in that set, and nothing else ran vet:

- name: Run unit tests
  run: go test -short ./pkg/...

The unit-test job now also runs go vet ./..., which covers test/ and tools/ as well. It is clean at this commit, so the job passes without any other change. Adding it to the existing required job rather than as a new one means no branch-protection changes are needed.

That also surfaced two no-op append(sliceLiteral) calls in the acceptance tests, fixed here - adding a vet gate while leaving known vet errors in the tree would be incoherent.

Deliberately not here

• Tagged vet. The step runs untagged, so the 22 acceptance build tags are unchecked. -tags basic is clean after this change; the rest are unverified. A tag matrix is a bigger conversation.
• A gofmt gate. Roughly 40 files on main are already unformatted, so enforcing it needs a repo-wide formatting pass first. Worth doing - it is the other half of why formatting regressions land unnoticed - but not as a rider on this.

Testing

No test. The race is between signal.Notify returning and a goroutine's first receive, which is not reachable from a unit test without a real TTY and precise timing; term.GetState fails outright under go test because stdin is not a terminal. go vet is the check that catches this class, which is why it is now wired into CI - that is the regression guard, rather than a test that would have to fake the very thing being fixed.

Verified: go build ./..., go vet ./..., go test -short ./pkg/..., and go test -tags basic ./test/acceptance/ all pass.