v1.1.0 — Subprocess leak fix + log viewer rewrite

🐛 Bug fixes

Subprocess PID leak (runtime: newosproc EAGAIN crash)

stackd was crashing after long uptime once accumulated subprocess PIDs hit the host's nproc ulimit. Root cause: exec.CommandContext only SIGKILLs the direct child, leaving ssh / docker compose / infisical grandchildren orphaned. SSH compounded it because GIT_SSH_COMMAND had no ConnectTimeout / ServerAliveInterval, so dead TCP made ssh hang forever.

Fix — new internal/execpg helper:

• Runs commands in their own process group (Setpgid=true) and SIGKILLs the whole group on context cancel.
• Adds WaitDelay = 5s so Wait() returns even if a grandchild keeps a pipe open.
• Migrated all exec.CommandContext callsites in internal/git/git.go and main.go (compose + infisical wrappers).
• Hardened GIT_SSH_COMMAND with BatchMode=yes, ConnectTimeout=10, ServerAliveInterval=10, ServerAliveCountMax=3.

Log viewer copy/select didn't work

The dashboard rendered logs to a <canvas> from a Web Worker, so there was no DOM text to select or copy.

Fix — replaced canvas/worker with a virtualized DOM list:

• Native Cmd/Ctrl-C, drag-select, and triple-click now work on visible text.
• 50,000-line soft cap, 8-row buffer above/below the viewport.
• Stable refs prevent SSE batches from dropping the active filter.
• Auto-follow only resets when the filter text actually changes.
• Trade-off documented: Cmd-F sees only the visible window — use the in-app Filter logs… input for full-buffer search.

📊 Observability

• New Prometheus gauges: stackd_goroutines, stackd_threads.
• New docs/observability.md section: Subprocess Leak Guard with --ulimit nproc=65535:65535 workaround.

📦 Dependency updates

Eleven dependabot PRs merged this release, including 4 closed security advisories:

• vite 8.0.3 → 8.0.10 (3 advisories: GHSA-v2wj-q39q-566r high, GHSA-p9ff-h696-f583 high, GHSA-4w7w-66w2-5vf9 medium)
• pgx v5 5.9.1 → 5.9.2 (GHSA-j88v-2chj-qfwx low)
• golang.org/x/crypto 0.49.0 → 0.50.0
• modernc.org/sqlite 1.48.0 → 1.48.2
• moby/moby/client 0.3.0 → 0.4.1, moby/moby/api 1.54.0 → 1.54.1
• preact 10.29.0 → 10.29.1, @fortawesome/react-fontawesome 3.3.0 → 3.3.1
• GitHub Actions: docker/build-push-action v5 → v7, docker/login-action v3 → v4, docker/metadata-action v5 → v6

🔧 Process

• Pre-push codex:review mandate added to .github/copilot-instructions.md.

Full Changelog: v1.0.0...v1.1.0