fix: Phase 4 — HIGH #16-17, MEDIUM #33-34,#43 main.go dedup + security

cmd/five/main.go:
  #16: Merge goPath() → alias for findGoBin() (removed 10-line duplicate)
  #17: Merge findProjectRoot() → alias for findFiveRoot()
       New walkUpForGoMod() helper shared by both strategies
  #33-34: Fix path injection in debugPRG
       Was: string concat with unescaped path
       Now: fmt.Sprintf(%q) for safe Go string escaping
  #43: findProjectRoot aliased to findFiveRoot (removes 3rd copy)

Issues resolved: #16,17 (HIGH), #33,34,43 (MEDIUM)
Total fixed: 34/53

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/.pdca-status.json

@@ -1,6 +1,6 @@
 {
   "version": "2.0",
-  "lastUpdated": "2026-04-01T02:57:07.253Z",
+  "lastUpdated": "2026-04-01T08:11:30.993Z",
   "activeFeatures": [
     "hbrt",
     "hbrtl",
@@ -137,7 +137,7 @@
       "documents": {},
       "timestamps": {
         "started": "2026-03-27T11:50:31.420Z",
-        "lastUpdated": "2026-04-01T02:43:37.339Z"
+        "lastUpdated": "2026-04-01T08:11:30.993Z"
       },
       "lastFile": "/mnt/d/charles/five/cmd/five/main.go"
     },
@@ -280,7 +280,7 @@
   "session": {
     "startedAt": "2026-03-27T06:06:49.620Z",
     "onboardingCompleted": false,
-    "lastActivity": "2026-04-01T02:57:07.253Z"
+    "lastActivity": "2026-04-01T08:11:30.993Z"
   },
   "history": [
     {
@@ -5766,6 +5766,30 @@
       "feature": "parser",
       "phase": "do",
       "action": "updated"
+    },
+    {
+      "timestamp": "2026-04-01T08:09:55.250Z",
+      "feature": "five",
+      "phase": "do",
+      "action": "updated"
+    },
+    {
+      "timestamp": "2026-04-01T08:10:51.607Z",
+      "feature": "five",
+      "phase": "do",
+      "action": "updated"
+    },
+    {
+      "timestamp": "2026-04-01T08:11:04.573Z",
+      "feature": "five",
+      "phase": "do",
+      "action": "updated"
+    },
+    {
+      "timestamp": "2026-04-01T08:11:30.993Z",
+      "feature": "five",
+      "phase": "do",
+      "action": "updated"
     }
   ]
 }