v0.2.6: fix: patch 5 security vulnerabilities found in audit (#12)

- Fail-fast nil dispatcher and zero buffer size in NewEventStore
- Recover panicking handlers in async workers so wg.Done() always fires
  and the worker pool is never silently exhausted
- Remove __ctx magic key from execute() and Transaction.Commit() to
  prevent context injection via Args
- Lock txMu in Rollback() to prevent concurrent Subscribe from losing
  events when head is reset
- Add regression tests for panic recovery and invalid constructor args

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>