Fix validation state isolation, error handling, and boundary checks

[strider2038]

Validation could leak goroutines after an async failure, corrupt reused violation lists, silently change derived rules, and lose fatal errors inside errors.Join. This fixes all twelve findings from the library review and adds regression coverage for each.

• Let async workers finish sending results after the receiver returns; copy list nodes when joining, including self and repeated joins.
• Traverse all joined-error branches, retain fatal errors, and preserve custom As behavior.
• Isolate derived argument paths and URL/IP/CIDR/UUID/ISBN/MAC constraint options; copy translation parameters so reused rules remain safe across languages and concurrent calls.
• Reject negative nonmultiples correctly and return configuration errors for zero divisors instead of panicking.
• Count hostname separators toward the length limit, compare reserved TLDs without case sensitivity, and cap IPv6 CIDR prefixes and reported limits at 128.
• Round-trip Unicode digits in property names and clear paths when unmarshaling empty text.

Examples covered by the regressions include IsDivisibleByFloat(2) rejecting -5, Filter(list, list) terminating without cycles, creating an allowed URL rule without weakening an existing denied rule, and preserving a backend error joined with a validation violation.

Validation: bash scripts/test-all.sh (formatting, vet, golangci-lint v2.13.2, unit tests, race tests, module tidy and verification), using Go 1.27.1. The new tests also check async worker cleanup and concurrent reuse of translated parameters. Updated CHANGELOG.md under Unreleased.