fix(process): unify subprocess ownership and child lifecycle safety

[somethingwithproof]

Summary

• make subprocess-registry detach atomic so exactly one closer owns each entry
• make cancellation cleanup release only the detached node it owns
• replace vfork/execve child setup with posix_spawn and explicit file actions
• mark every pipe and stdio-collision duplicate close-on-exec
• restore the child's default SIGPIPE disposition while preserving the parent's handling
• bound TERM/KILL reaping and park unreaped children in a fixed-capacity sweep list
• harden PHP script-server slot ownership, startup, restart, signal, descriptor, and cleanup paths
• retire and restart failed or oversized reads so stale response tails cannot poison later data sources
• revalidate every command retry and cap recovery handshakes at two seconds

This folds the child-process lifecycle portion of #597 into the narrower ownership PR. It does not absorb unrelated poll-host, SQL, SNMP, ICMP, or build-infrastructure work.

Review-driven corrections

• close-on-exec is explicitly restored after dup() in both read and write stdio-collision branches
• the source invariant check now uses portable POSIX character classes
• direct tests cover duplicate flags, both collision branches, failure after pipe creation, abandoned-child sweeping, and capacity overflow
• collision cleanup preserves current-child redirects even when an older registry entry occupies fd 0 or 1
• script children receive SIGTERM before SIGKILL and unreaped PHP children transfer to the bounded sweep registry
• the Docker integration suite now starts a real PHP script server, verifies its startup protocol and database result, and checks that shutdown leaves no zombie PHP process

Validation

• Ubuntu 24.04 container with GCC and GNU ld: make check, 6/6 targets passed with no skips, including test_php_runtime
• real PHP script-server Docker integration: 6/6 checks passed; exact value 42 reached poller_output and no zombie remained
• macOS Homebrew dependency build passed
• macOS make check: 5/5 available binaries passed; GNU --wrap runtime suite is Linux-only
• PHP fixture syntax checked through mise PHP 8.3
• actionlint, shellcheck, and git diff --check passed

Closes #610.

[Copilot]

🟢 Approval recommended

The changes correctly enforce exclusive registry ownership under ListMutex, add targeted tests for the new invariants (including cancellation), and include a safety guard against dangerous kill() PID values.

Pull request overview

This PR hardens nft_pclose()’s subprocess registry handling so that closing a nft_popen() descriptor transfers exclusive ownership to exactly one closer, preventing duplicate close/wait/free races and aligning behavior with issue #610’s acceptance criteria.

Changes:

• Refactors nft_pclose() to atomically detach+close the registry entry under ListMutex and free only the detached node via the cleanup handler.
• Adds unit tests that exercise concurrent close ownership, cancellation cleanup behavior, and preservation of pthread cancellation state on early EBADF.
• Guards the timeout kill path in exec_poll() against invalid/unsafe PIDs and records the fix in CHANGELOG.

File summaries

File	Description
tests/unit/test_linked.c	Adds concurrency/cancellation-focused unit tests for nft_pclose()/registry ownership semantics.
poller.c	Prevents kill() from being called with invalid PIDs on NIFTY POPEN timeout.
nft_popen.c	Introduces atomic detach-and-take helper and updates nft_pclose() cleanup ownership model.
CHANGELOG	Documents issue #610 fix.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.