feat: comma-ok guard remaining type assertions for defence-in-depth #55

Summary

LoadOrStore (line 53) asserts a.(V) unconditionally, and Range, Keys, Values assert key.(K) / value.(V) without comma-ok. All four are provably safe today because only the typed public API writes to the sync.Map — but they contradict the defensive pattern used in Load, LoadAndDelete, Swap. A future refactor that exposes syncMap or adds an untyped write path silently introduces a panic.

Scope

Add comma-ok form to all type assertions in syncmap.go:

v, ok := a.(V)
if !ok { var zero V; return zero, ... }

Acceptance criteria

1. grep -nE '\.\(V\)|\.\(K\)' syncmap.go shows only comma-ok asserts.
2. Remove the TODO(#7) exclusion for forcetypeassert in .golangci.yml.
3. Coverage remains 100%, no behaviour change for the happy path.

Source: code-reviewer + security-reviewer + performance-reviewer.