fix(shell): kill + reap the child process group on timeout (AB-006)

[hartsock]

Summary

Fixes #269 / AB-006. ShellTool's safe-subset engine, on timeout, detached the blocking worker and killed nothing — the child and its descendants ran to completion; the caller saw timed_out: true while the system had merely stopped waiting (the post-sleep side effects still happened).

Now the timeout is enforced where the children live:

• each pipeline stage is spawned as its own process-group leader (process_group(0));
• run_pipeline polls the stages with try_wait to a deadline and, on the deadline, SIGKILLs each stage's process group (so grandchildren die too) and reaps them;
• Captured carries a confirmed-timeout flag; the envelope's timed_out is derived from a real termination.

The outer tokio timeout now only bounds when invoke returns — even if it fires and detaches the worker, that worker keeps running run_pipeline, which reaches the same deadline and does the kill+reap. This mirrors the Brush engine's existing kill_worker_tree supervisor. rustix (already a Brush dep) is made non-optional to provide the safe kill_process_group under the crate's #![forbid(unsafe_code)].

Test plan

Non-privileged real-spawn E2E regressions (validated locally):

• real_timed_out_child_is_killed_and_never_writes_marker — sh -c 'sleep 3; touch M' under a 1s timeout → timed_out: true and M never appears after the sleep window. Before the fix the detached child wrote it.
• real_timed_out_grandchild_is_killed — nested sh -c 'sh -c "…"' proves the process-group kill reaches a grandchild.
• All 56 lib tests pass (the two existing mock-based timeout tests still hold once the outer timeout is the return-bound, not the killer); clippy -D warnings + fmt clean; full pre-push gate incl. bare-Brush [pre-push] OK.

Scope

agent-bridle-tool-shell. The Brush engine already handled this; this brings the safe-subset engine to parity. Windows Job-Object teardown (vs the Unix process group) remains a follow-up — the #[cfg(unix)] group-kill is a no-op there and falls back to child.kill().

Fixes #269

🤖 Generated with Claude Code