Make server teardown safe against pid reuse and refuse to erase unreadable stores

[quantizor]

Settles the process-safety cluster from the backlog: teardown that could signal the wrong process, a deliberate stop that left an escaped descendant running, a crash sweep that signaled an already-reaped pid, and a store read failure that erased real data. Stacked on #19; review that first.

Teardown never signals a recycled pid

Every signal devctl sends while tearing a server down is now checked against the identity it recorded for that process while it was alive. A pid the kernel has since handed to something else is never signaled. The deliberate-stop and crash-cleanup paths share one revalidated sweep (signalRun over ProcessTree.liveDescendants), which unions the three ways a descendant can be found: the startup snapshot, a fresh parent-chain sweep, and the root's session members. The root's process group is signaled only while its pid still names the recorded process; the crash path, whose root is already reaped, never signals the group at all.

This closes three gaps that were separate backlog entries:

• A stop racing a start could kill the wrong process. The teardown read the mutable pid and signaled without revalidation, so a restart that recycled the pid meant the signal could land anywhere, including the caller. recordOutcome now captures the run's pid, session, and snapshot at entry, before a concurrent start can replace them, and revalidates before every signal.
• A deliberate stop left escaped descendants running. Stop swept only the parent chain, so a helper that backgrounded a grandchild and then exited left the grandchild reparented and alive. Stop now sweeps the whole session too.
• The crash sweep signaled a reaped pid. It sent kill(-pid) after waitpid had already reaped the root; a recycled group would take the signal. The crash path now passes no root identity, so the group is never signaled, and only the descendants that still match are.

signalTree also no longer skips a group member when the group itself was not signaled, and the now-redundant escalateIndividuals folds into it.

The daemon refuses to start rather than erase its records

AtomicFile.load separates three outcomes a single nil used to blur together: a missing file (start empty), a file that exists but cannot be READ (throws), and a file that reads but will not parse (quarantined, start empty). The daemon probes its registry, run state, and lock stores this way before serving and exits on a read failure (EMFILE as it nears its fd limit, an I/O error), so launchd retries instead of the next write overwriting real data with an empty store. loadDefensively keeps the collapse-to-nil behavior, now used only for the rebuildable update cache and secondary hint reads.

Verification

• make test passes (7 new tests). deliberateStopKillsAnOrphanedSessionGrandchild uses a new --orphan-grandchild fixture mode to create a session-only descendant and asserts stop reaps it; concurrentStopAndStartNeverSignalTheWrongProcess races stop against starts across rounds and confirms the host process survives and the server settles; AtomicFileTests cover missing, valid, corrupt, and unreadable.
• scripts/smoke.sh passes (whole-group death on stop and child survival across a daemon kill are unchanged); each commit builds in isolation.

Not claimed here

This addresses the teardown signalling safety. A separate question of continuation timing under heavy concurrent stop/start churn is not part of this change; the tests here bound child lifetime so a regression slows a case rather than hanging the suite.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.