fix: harden driver lifecycle supervision

[WH-2099]

Summary

• Validate driver wire inputs and unsupported provider configuration before execution.
• Make cancellation, terminal delivery, and shutdown cleanup fail closed.
• Supervise ACP, Claude, and OpenAI process trees through provider exit and driver crash.
• Cache verified Linux process identities so unrelated restricted /proc entries cannot disable cleanup.
• Preserve terminal exit-before-release ordering when cleanup ownership changes after a deadline.
• Buffer ACP session updates until session/new establishes the authoritative session ID.
• Expand packed-artifact live coverage for lifecycle, permission, resume, MCP, signal, heartbeat, and disconnect boundaries.
• Make long-tool startup fail early on terminal, protocol, exit, or dead-process evidence.
• Improve structured diagnostics while redacting credentials before JSON escaping.
• Remove duplicated lifecycle harness setup without removing scenarios or assertions.

Validation

• vp run check: 1231 passed, 40 live or capability-gated tests skipped, 0 failed, 3602 assertions.
• vp exec bun test --coverage: 90.37% functions, 90.28% lines, 1231 passed, 0 failed.
• Restricted /proc integration with CAP_SYS_PTRACE dropped: 45 passed, 2 capability-gated tests skipped, 0 failed.
• Process-group cleanup stress: 100 rounds passed with no leaked process.
• vp run test:live: 38 passed, 0 failed, 17544 assertions in 577.40 seconds.

Follow-up

• feat(runtime): isolate provider trees with a Linux subreaper guardian #85 tracks strict containment of a child that clears its environment and detaches before the first user-space snapshot.

Closes #83

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.