Security fix: pivot_root replaces chroot

1.15 is a hardening release:

• pivot_root instead of chroot — closes a container-escape vector and

places the root filesystem in a proper mount namespace.

• Linux-only build tags — //go:build linux on platform-specific files.
• cardinal stop --all — stop every running container at once.
• cardinal exec -i/-t — interactive exec flags now parse and apply

correctly, and cardinal console auto-detects a shell.

Plus a batch of correctness fixes: a sync.Map guard against a stop/monitor

race, error paths that no longer swallow failures, and 30-second timeouts on

volume and network commands.