fix: 4 P0 concurrency races in forward + k8s

P0 #2 — currentConfig data race
  Manager.currentConfig was written without locking in Start/Reload but
  read from the health-checker callback goroutine. All accesses now go
  through workersMu (read or write as appropriate).

P0 #3 — Reload kills health checker permanently
  Reload's zero-forward branch called m.Stop() which tore down the
  health checker, watchdog, and event bus. After that, EnableForward
  silently registered callbacks against dead components. Now the branch
  stops only the running workers; the supervisory infrastructure stays
  alive across config changes.

P0 #4 — rest.Config write-write race
  executePortForward was mutating .Dial on the cached *rest.Config
  shared by all forwards in the same kube context. Cloning the config
  with rest.CopyConfig before mutation isolates per-forward dialers.

P0 #5 — ForwardWorker.Stop() double-close panic
  close(w.stopChan) is now wrapped in sync.Once, so concurrent Stop
  calls (Manager.Stop racing stopWorkerInternal) are safe.

New tests in internal/forward/concurrency_test.go exercise each fix
under -race: 16 concurrent worker Stops, repeated sequential Stops,
empty-Reload preserves infra pointers, and concurrent currentConfig
read/write.

internal/k8s/portforward.go

@@ -185,9 +185,15 @@ func (pf *PortForwarder) forwardToService(ctx context.Context, req *ForwardReque
 
 // executePortForward performs the actual port-forward operation.
 func (pf *PortForwarder) executePortForward(config *rest.Config, url *url.URL, req *ForwardRequest) error {
+	// Clone the rest.Config before mutating. ClientPool.GetRestConfig returns a
+	// cached pointer shared across all forwards on the same context; mutating
+	// config.Dial directly causes a write-write race when multiple forwards
+	// run concurrently against the same context.
+	cfg := rest.CopyConfig(config)
+
 	// Configure TCP settings on the underlying connection
 	// This is set in the rest.Config which will be used by the SPDY transport
-	if config.Dial == nil {
+	if cfg.Dial == nil {
 		// Create a custom dialer with configurable timeout and keepalive
 		// - Timeout: How long to wait for connection to establish
 		// - KeepAlive: TCP keepalive helps OS detect dead connections at network layer
@@ -195,11 +201,11 @@ func (pf *PortForwarder) executePortForward(config *rest.Config, url *url.URL, r
 			Timeout:   pf.dialTimeout,  // Configurable dial timeout
 			KeepAlive: pf.tcpKeepalive, // Configurable keepalive interval
 		}
-		config.Dial = dialer.DialContext
+		cfg.Dial = dialer.DialContext
 	}
 
 	// Create SPDY roundtripper
-	transport, upgrader, err := spdy.RoundTripperFor(config)
+	transport, upgrader, err := spdy.RoundTripperFor(cfg)
 	if err != nil {
 		return fmt.Errorf("failed to create round tripper: %w", err)
 	}