fix(process): preserve partial evidence and verify detached cleanup (#1011)

* test(ci): allow transport delivery in source identity regression

* fix(process): preserve partial evidence and verify detached cleanup

* fix(process): scope Linux token sweeps by stable process identity

* fix(process): retain environment permission failure codes

* fix(process): wait for signaled processes before verifying cleanup

* fix(process): verify sampled detached groups during cleanup

* fix(electron): preserve prelaunch identities through cleanup

* fix(process): retry growing Darwin process table snapshots

* fix(process): retain compatibility with saved v3 capture evidence

* fix(process): migrate saved v3 captures during reconstruction verification

* fix(process): preserve cancellation during Darwin helper compilation

* fix(process): propagate cancellation through ownership baselines

* perf(javascript): cache canonical export comparison sort keys

* fix(process): cancel provider ownership preparation before spawn

* fix(process): isolate native compiler waiter cancellation

src/process/ProcessOwnership.part2.test.ts

@@ -180,3 +180,38 @@ describe("owned process-group cleanup discovery", () => {
     });
   });
 });
+
+describe("process environment permission diagnostics", () => {
+  it.each(["EACCES", "EPERM"])(
+    "preserves %s while refusing to signal an unverifiable live process",
+    async (code) => {
+      const signalGroup = vi.fn();
+      const diagnostic = `${code}: permission denied, open '/proc/900/environ'`;
+      const adapter: ProcessOwnershipHost = {
+        listProcesses: () =>
+          Promise.resolve([
+            {
+              pid: 900,
+              parentPid: 1,
+              processGroupId: 900,
+              state: "S",
+              command: "unverifiable-process",
+            },
+          ]),
+        environment: () => Promise.reject(new Error(diagnostic)),
+        signalGroup,
+      };
+      await expect(
+        cleanupOwnedProcessGroup(
+          { ...ownership, sweepTokenOwnedProcesses: true },
+          adapter,
+        ),
+      ).resolves.toMatchObject({
+        cleaned: false,
+        reason: `process ownership token could not be read for 1 live process(es): environment_errno_${code}=1`,
+        failures: [{ pid: 900, reason: "environment-unreadable", diagnostic }],
+      });
+      expect(signalGroup).not.toHaveBeenCalled();
+    },
+  );
+});