test(state): pin v1.0 freeze-critical surface; rename ErrActorPanic

[joshua-temple]

Pre-v1.0-freeze hardening for crucible/state. Closes the gaps the freeze sign-off review flagged.

Tests added (previously 0% coverage on the exported contract)

• SystemClock Now/After — the default production clock for after/delayed transitions, now driven through a real firing (fake-clock tests skipped this path).
• WithSpawnInput round-trip; actor Output.
• guard LeafRefs / StateInTargets; ForbidAny.
• Nested parallel-in-parallel done-cascade — the highest-risk previously-untested semantic path. Pins innermost-first OnDone firing, each exactly once. No engine bug found; the cascade is correct.

Coverage: SystemClock/WithSpawnInput/Output/LeafRefs/ForbidAny → 100%; StateInTargets → 88.9% (uncovered arm is the g==nil guard).

Breaking (pre-v1.0)

• Rename ErrActorPanic → ActorPanicError for consistency with the package's other typed errors. CHANGELOG updated.

Verification

go build/go vet clean; go test ./... -race green across all 6 packages; golangci-lint run clean.

Open question for v1.0 owner (not addressed here)

ForbidAny() currently shadows an explicit same-state On(event) handler (forbids() is checked before matchingTransitions()). The doc says it blocks events "not otherwise handled," which arguably should let a same-state handler win. The test deliberately avoids this contested precedence. Decide before freeze whether forbid-beats-same-state-handler is intended, or reconcile doc vs behavior.

[joshua-temple]

Superseded by #162, which salvages this PR's freeze-critical coverage (parallel-in-parallel cascade test; SystemClock/LeafRefs/Output/WithSpawnInput zero-coverage funcs) onto main. The ErrActorPanic→ActorPanicError rename here is already on main via #155 (with Unwrap() and a Recovered field).