fix(process): preserve ownership through termination and cleanup (#9891)

* fix(process): revalidate ownership before signaling

* fix(process): retain cleanup ownership until completion

* fix(process): keep omitted live descendants unresolved

A non-empty process table that omits a retained live PID cannot authorize a signal or certify cleanup. An empty table can still describe a token-verified owner.

* fix(process): read omitted Darwin run tokens by PID

A live identity that ps omitted was still validated through Darwin
environment(), which rejects any PID absent from a second process table.
Ask the native reader for that PID directly so the launch token can bind.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/process/DarwinProcessRunTokenReader.finalization.test.ts

@@ -172,7 +172,7 @@ it("decodes a successful native snapshot absence as a distinct identity fact", a
     environment: {},
   });
   try {
-    const operation = reader.identities([
+    const processes = [
       {
         pid: 123,
         parentPid: 1,
@@ -180,7 +180,8 @@ it("decodes a successful native snapshot absence as a distinct identity fact", a
         state: "S",
         command: "fixture",
       },
-    ]);
+    ];
+    const operation = reader.identities(processes);
     await command.waitUntilStarted();
     command.release();
     await expect(operation).resolves.toEqual(
@@ -211,26 +212,17 @@ it.each(["read", "identities"] as const)(
       await Promise.allSettled([operation, closing, reader.close()]);
     });
 
+    const processes = [
+      {
+        pid: 123,
+        parentPid: 1,
+        processGroupId: 123,
+        state: "S",
+        command: "fixture",
+      },
+    ];
     operation =
-      mode === "read"
-        ? reader.read([
-            {
-              pid: 123,
-              parentPid: 1,
-              processGroupId: 123,
-              state: "S",
-              command: "fixture",
-            },
-          ])
-        : reader.identities([
-            {
-              pid: 123,
-              parentPid: 1,
-              processGroupId: 123,
-              state: "S",
-              command: "fixture",
-            },
-          ]);
+      mode === "read" ? reader.read(processes) : reader.identities(processes);
     await command.waitUntilStarted();
 
     let closeSettled = false;
@@ -273,25 +265,7 @@ it.each(["read", "identities"] as const)(
       ]),
     );
     await expect(
-      mode === "read"
-        ? reader.read([
-            {
-              pid: 123,
-              parentPid: 1,
-              processGroupId: 123,
-              state: "S",
-              command: "fixture",
-            },
-          ])
-        : reader.identities([
-            {
-              pid: 123,
-              parentPid: 1,
-              processGroupId: 123,
-              state: "S",
-              command: "fixture",
-            },
-          ]),
+      mode === "read" ? reader.read(processes) : reader.identities(processes),
     ).rejects.toThrow("closed");
   },
 );