Go v2: FFI robustness & fault-testing suite (continuous)

[ananth7592]

Part of the Cosmos DB Go SDK v2 (azcosmos/v2) effort, delivering the Go v2 data plane over an FFI/cgo binding to the shared Rust Cosmos driver (decision: Azure/azure-sdk-for-go#27238, ADR docs/adr/0001-go-v2-uses-ffi.md). This is the umbrella robustness track that begins the moment the boundary first exists and re-runs against every surface later milestones add. Self-contained; owners decide how to complete it.

Scope (applied per milestone, from the vertical slice onward)

• Error propagation: every Rust Result/status/sub-status crosses to a Go error with no loss of activity id, RU charge, or diagnostics.
• Edge-case payloads: nil/empty/oversized bodies, invalid UTF-8, boundary integers, deeply nested JSON.
• Panic safety: a Rust panic never crosses as a process abort — it surfaces as a Go error and leaves the client usable.
• Cancellation: Go context cancel/deadline cuts an in-flight FFI call and reclaims resources.
• Hangs / deadlocks: timeout watchdogs; detect blocked/pinned OS threads; no permanent goroutine leak.
• Memory ownership: ASan/LSan + Go race detector — no leak, double-free, or use-after-free; a clear allocate/free ownership contract per call.
• Concurrency: many goroutines sharing one client; callback re-entrancy (AAD token-refresh invoked from Rust back into Go).

Deliverables

• An FFI fault-injection suite wired into CI; a sanitizer build lane; a documented cross-boundary memory-ownership model; a per-milestone boundary-conditions checklist run as part of each milestone's exit.

Definition of done

• Suite passes on every target with no leaks/aborts/hangs under sanitizers; ownership model documented; each milestone from M3 onward has cleared its boundary-conditions checklist. Gates GA.