fix: address Plan 2 final-review findings

- tui/doc.go: remove teatest blank import (test harness in prod binary)
- cmd: honor wizard HaltOnError toggle in addition to --halt-on-error flag
- cmd: wire SIGINT/SIGTERM to root context via signal.NotifyContext
- dashboard/run: derive engine context and cancel on tea.Program exit
  so the engine goroutine does not outlive Run

internal/tui/dashboard/run.go

@@ -23,10 +23,18 @@ func Run(ctx context.Context, reg *module.Registry, state tui.WizardState, halt
 	m := NewModel(selected, nameByID)
 	p := tea.NewProgram(m, tea.WithContext(ctx))
 
+	// Derived context so that when p.Run() returns (user pressed q, tea
+	// errored, parent ctx cancelled) the engine goroutine is cancelled
+	// too. Deferred cancel ensures no orphan goroutine outlives Run.
+	engineCtx, cancelEngine := context.WithCancel(ctx)
+	defer cancelEngine()
+
 	reporter := tui.NewTeaReporter(p)
 
 	go func() {
-		summary, err := engine.Run(ctx, reg, engine.RunOptions{
+		// TODO(plan-3): forward state.Parallelism once engine.RunOptions
+		// gains a Parallelism field and the engine supports concurrent Apply.
+		summary, err := engine.Run(engineCtx, reg, engine.RunOptions{
 			Selected:    selected,
 			HaltOnError: halt,
 			Reporter:    reporter,