fix: address code review findings across spec and TCK

[peter-svensson]

Summary

• Fix data race in RunTCKWithReport by adding sync.Mutex around report mutations
• Add goroutine leak comment in readResponse (subprocess killed immediately after)
• Remove duplicate Kind* constants from naming.go, use typed ExchangeKind constants
• Replace bare http.Get with http.NewRequestWithContext + basic auth in TCK broker client
• Add context.WithTimeout to fetchJSON in discover.go and deleteResource in broker_amqp.go
• Move cleanup loop into deferred function in cliRunner.Run to guarantee execution on panic
• Fix stale comment count in coverage.go (11, not 9)
• Simplify RoutingKeyOverlaps to single return statement
• Use strings.NewReplacer at package level instead of nested strings.Replace
• Extract readTopology helper to fix defer f.Close() in loop
• Return write errors from writeResult/writeError in adapterutil
• Add doc comment specifying Duration is in nanoseconds
• Improve ErrParseJSON error message
• Panic on crypto/rand error in randomSuffix
• Emit one Mermaid style line per node ID for spec compliance

Test plan

• go vet ./... passes
• go build ./... passes
• go test ./... -short passes (updated visualize test expectations)