Fix residual-output CI race

[xor-machine]

Summary

• make the residual-output concurrency fixture arm its TERM handler before the parent suite completes
• preserve the exact fail-closed 65,536-byte output-cap diagnostic and process-group cleanup contract
• provide the one-slice workstream fix that will refresh PR Complete Experiment onboarding- #36 #37 after this draft is merged into dev

Motivation / Context

PR #37's Fast job failed because the residual-flood fixture could receive TERM before its background child installed the flood handler. The production gate correctly returned a generic residual-process infrastructure diagnostic in that state, but the fixture expected the output-cap diagnostic. Because the same dev tree could also pass, the fixture setup was scheduler-dependent.

This changes only the test fixture synchronization. The production security gate, output limits, diagnostics, and cleanup behavior remain unchanged.

Changes

• add distinct STARTED, ARM, and READY signals in the fixture's fresh per-run temporary directory
• make the child publish STARTED, wait for ARM, install its TERM flood handler, and publish READY
• make the parent wait for STARTED, publish ARM, and wait for READY before completing
• bound both parent waits and fail closed with status 125 if either handshake cannot complete

Testing

• rejected the initial delay-based attempt (c3946f4 / b5c10bc) after a 300 ms scheduling mutation exposed a false green
• authoritative RED (a9ab07f): withholding ARM reliably failed the exact output-cap diagnostic and timing assertions while process-group cleanup remained green
• GREEN (2ca15d7): the complete concurrency suite passed with SUMMARY failures=0; the focused residual-output case passed 30/30 repetitions
• adversarial mutation: removing the readiness wait produced both expected named failures in 5/5 repetitions while cleanup remained green
• ./scripts/dev/check default quick: SECURITY GATE SUMMARY pass=32 fail=0 skip=0 infra=0
• ./tools/validate.sh --strict: validate: PASS; containment lint reported 0 failures and 0 warnings
• slice PR Make residual-output CI evidence deterministic #38: Fast, Static, Docker security, Analyze, CodeQL, and Required gates all passed