feat(ghost,ci): ghostd exit-is-a-feature + ADR-0023 Part-1 integration gate

[NickFlach]

The follow-up increment ADR-0023 named in its residual risks: the qsh-exit leg proves Part 2 but never exercises the one direction where Part 1's dead-target unlink is load-bearing in the live routing path — the TARGET restarting under a LIVING sender.

Changes

• GHOST_EXIT (op 6): ghostd terminates on request, mirroring qsh's exit-is-a-feature. Any ghostd IPC-cap holder may ask (the same trust domain that can already flood every other op); no reply; abuse is bounded by ghostd's max_restarts budget.
• qsh ghost exit sub-command (standard arg_of dispatch; usage line on unknown subs).
• ci-smoke Part-1 integration leg: the session sends ghost exit to the living reborn shell, then a fourth ghost. New gate asserts a qsh: ghost R= in the post-GHOSTD: FIELD REBORN slice, plus explicit GHOSTD: exiting / FIELD REBORN presence asserts. Inherently non-vacuous: a dropped kill never prints the banner and the slice is empty. Session timeout 26s → 34s.
• ADR-0023 residual-risks updated: the deferred integration leg is now shipped.

Why the gate proves what it claims

The living shell holds a qsh→ghostd cap across ghostd's death. Without Part 1, that stale cap sits at a lower first-fit slot than the Pass-2 re-mint and wins untargeted send_msg first-match, routing to the dead pid — no answer. Only unlink + re-mint together produce the post-rebirth R=.

Verification (local WSL)

• Forward: full make ci-smoke PASSES; the reborn ghostd landed on a recycled pid (5, was 17) — the exact scenario the unlink protects — and the living shell still answered.
• Revert-confirm (tag-scoped unlink restored + self-test made consistent, so the ONLY behavioral delta is the live routing path): boot green, qsh rebirth green, Part-2 gate still green (clean isolation), ghost exit delivered, ghostd reborn — and the Part-1 gate fails with qsh: ghost send denied (EPERM). Part 1 is load-bearing.

🤖 Generated with Claude Code