Make residual-output CI evidence deterministic

[xor-machine]

Summary

• make the residual-output flood fixture prove its TERM handler is installed before the suite leader exits
• preserve the exact output-cap diagnostic, infrastructure classification, early flood termination, and process-group cleanup assertions
• change only the concurrency test harness; production gate behavior is unchanged

Motivation / Context

PR #37 failed the Fast job at residual descendant output-cap diagnostic is exact. The runner returned infrastructure status and removed the residual process group, but the fixture's child received TERM before it installed the flood trap. Because no output cap was crossed, the runner truthfully emitted the generic residual-group diagnostic instead of the expected output-cap diagnostic.

The same content had passed another run, proving this was a fixture scheduling race rather than an Experiment or release-content regression.

Changes

• add distinct fresh STARTED, ARM, and READY paths to the residual-flood fixture
• have the child publish STARTED while TERM is ignored, wait for parent-owned ARM, install the flood trap, then publish READY
• have the parent wait boundedly for STARTED, publish ARM, wait boundedly for post-trap READY, and fail closed with status 125 if either phase is unavailable
• pass the same phase paths through the existing residual-output-monitor sensitivity mutation

The first delay-based attempt in c3946f4 / b5c10bc was rejected because a sufficiently long scheduler pause could make its RED false-green. The authoritative a9ab07f / 2ca15d7 cycle replaces elapsed-time ordering with the schedule-independent phase protocol.

Testing

• RED at a9ab07f: bash tests/dev/security-gate-concurrency-cases.sh returned 1 with two named failures caused by withheld ARM: the generic diagnostic replaced the exact output-cap diagnostic, and the deliberately unarmed child exceeded the pre-completion timing oracle; infrastructure status and group cleanup still passed
• GREEN at 2ca15d7: bash tests/dev/security-gate-concurrency-cases.sh returned 0 with SUMMARY failures=0
• focused GREEN replay: 30/30 passes with exact diagnostics and clean process groups
• wait-removal mutation: 5/5 runs restored both named REDs while process-group cleanup still passed
• ./scripts/dev/check default quick: 32 passed, 0 failed, 0 skipped, 0 infrastructure failures
• ./tools/validate.sh --strict: passed
• git diff --check origin/dev...HEAD: passed