fix: patch 5 security vulnerabilities found in audit

[Raezil]

• Fail-fast nil dispatcher and zero buffer size in NewEventStore
• Recover panicking handlers in async workers so wg.Done() always fires and the worker pool is never silently exhausted
• Remove __ctx magic key from execute() and Transaction.Commit() to prevent context injection via Args
• Lock txMu in Rollback() to prevent concurrent Subscribe from losing events when head is reset
• Add regression tests for panic recovery and invalid constructor args