feat(testing): deterministic process-signal lifecycle support in Repl.Testing - #90

Repl.Testing carried `GenerateDocumentationFile=false`, the override the five test projects share. It
is not a test project though — it is a package on NuGet, and without a documentation file its
consumers get no IntelliSense on any of its public API.

Turning generation on also arms CS1591, which is an error here, so a new public member can no longer
ship undocumented. That surfaced 20 existing members with no `<summary>`: the types were documented,
their members largely were not. This documents all 20 and leaves the build at 0 warnings.

Separate from the process-signal work in this branch so it can be reviewed on its own.

Ten threads, all of them right.

**Dogfooding, from the owner.** The test host wrote its readiness marker with `Console.WriteLine`.
It goes through `IReplIoContext.Output` now, like any other command in this repository.

**A declared platform could claim a signal it would never receive.** `SendSignal(Terminate)` called
the claim logic directly, bypassing the wiring decision the declared platform makes. On a declared
Windows profile the framework installs no SIGTERM registration, and on an unsupported one it installs
nothing at all, so the harness reported a cancellation that could not happen on the platform the test
named — the exact false positive the platform-declaration feature exists to prevent.

Gated on whether SIGTERM is actually wired for the platform in force. Two of this branch's own tests
failed immediately on that change, because both asserted a SIGTERM claim under the default profile,
which on a Windows host is Windows. They were asserting the false positive. They declare Unix now, so
they say what they mean and pass identically on every host.

**A swallowed timeout was reported as success.** The timeout only surfaced through an exception
filter, so an application that maps cancellation to an exit code — or a command that catches it —
returned normally and the run looked like it had succeeded, for a signal that never arrived. The
timeout is now checked after a normal return too, the way `ReplSessionHandle` already does.

**A start queued behind disposal could launch into a torn-down harness.** `StartRunAsync` checked
disposal before waiting on the start gate, so a start that queued while disposal held the gate would
resume afterwards and run outside the isolation that had just been dismantled. Re-checked after
acquiring it.

**Isolating while someone else's run is in flight corrupts that run.** Taking ownership tears down
registrations without touching the scopes using them, so an unrelated automatic run would keep its
place in the epoch and be cancelled by this harness's first signal. Creation is refused while any
scope is active, with a message saying why.

Also: the probe could reject a child that had written its marker but not yet flushed it through the
asynchronous capture, and could throw during disposal when the child exited between the check and the
kill; a failed run left its explicitly named session in the process-wide dictionary; the tokenizer was
documented as shell-like when it splits on whitespace and groups with double quotes and nothing more;
and `TimelineEvents` promised an ordering between output and interactions that `BuildTimeline` does
not produce — output is one aggregate event, not interleaved.

Three new guards: SIGTERM honours the declared wiring, a swallowed timeout still fails, and a harness
is refused while an unrelated run holds a scope.

Release build 0 warnings. Repl.Tests 787/787, IntegrationTests 600 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6.

Five threads, all correct, three of them P1.

**The harness ran every command as a hosted session.** `ReplSessionIO.SetSession` defaults
`isHostedSession` to true, and `CoreReplApp` turns that into `ReplRuntimeChannel.Session`. So a harness
documented as modelling the process-owning standalone invocation was running the application through
the hosted lens: commands gated to the CLI channel invisible, `IReplIoContext.IsHostedSession` reading
true, output policy on the hosted surface. A fidelity bug in the one thing this PR exists to provide.
Both capture sessions now say `isHostedSession: false`.

**The timeout could not fire for a command that ignores its token.** `CancelAfter` only requests
cancellation. The new test hung for 45 seconds and was killed — not a failing assertion, a stuck
suite, which is precisely what the timeout exists to prevent. It is now measured against the clock:
the run's completion faults whatever the run is doing, and draining on disposal is bounded the same
way. Such a run cannot be killed, so it is abandoned — and because it still holds a place in the
process-wide epoch, disposal reports it rather than letting the next test inherit it. Draining allows
twice the run timeout, since it can begin before a run's own timeout has elapsed and the run still has
to unwind after it fires; a run that faulted on its own timeout is a finished run, not an abandoned
one.

**Harness exclusivity was a snapshot, not a claim.** Checking `ActiveScopes` once left a gap: a run
registering afterwards joined the harness's isolated epoch, fired its shared readiness callback —
releasing `StartRunAsync` before the harness's own run had registered — and was then cancelled by the
next `SendSignal`. The coordinator now takes an ownership claim atomically with that check and holds
it until released; while held, `Register` refuses any scope the owner did not launch, and the
readiness callback fires only for owned ones. The harness marks its runs with an `AsyncLocal` before
launching them, so the marker flows into the context where the scope is constructed. A concurrent
unrelated run now fails loudly, which is the right outcome: it is concurrent with a signal test, which
the documentation already forbids. `ActiveScopeCountForTesting` is gone, superseded.

Probe: a marker written during the final poll was rejected even though the failure message contained
it — one last check before giving up. And the process-tree cleanup guarantee was overstated: the tree
is only reachable while its root is, so a child that spawns something long-lived and exits leaves it
running. Holding descendants beyond the parent needs a job object or process group, which is
platform-specific work tracked in #91; the documented guarantee now says what the code does.

The stress filter's minimum rises 32 → 39 to match the new tests.

Release build 0 warnings. Repl.Tests 787/787, IntegrationTests 603 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6. Stress script green.

Seven threads, all correct, three P1. Two of them are real flake sources in the ownership work added
last round.

**An empty scope set is not an idle coordinator.** `UnregisterAsync` removes a scope before its
signal-triggered callbacks have drained and keeps the claimed signal alive until they have, so
claiming ownership in that window handed the next harness an epoch that was still claimed — its first
run would be cancelled on registration, with no signal ever sent. The claim now also requires the
pending drain and the claimed signal to have cleared.

**The owned-run marker belonged to nobody in particular.** It was a bare flag, and a flag flows into
anything a handler spawned: a background task outliving its harness would still read as owned and
could join whichever harness owned the coordinator next, even releasing its readiness wait. The marker
now carries the claim itself and is compared by reference, so a stale context is refused.

**The registration wait could hang despite the timeout.** The run's own timeout starts inside the run,
after the application factory returns, so a factory that blocks left `StartRunAsync` waiting on two
tasks that would never complete — and the cancellation token documented as cancelling that wait did
nothing. It is now bounded by both.

**A TimeoutException from the application was relabelled as the harness's.** `WaitAsync` propagates
the run's own exception, and a blanket catch turned a slow provider build into "the run exceeded its
timeout", sending the test after a deadline that had not elapsed. Only the wait's own timeout is
converted now, which is the same distinction the drain already makes.

Probe: a `kill` that never returns left a stray sender process and threw a bare timeout without the
captured output every other wait on that type promises — it is terminated and described now. And
redirected output is read a line at a time, so a marker written without a trailing newline is not seen
until the stream closes; that is now the documented contract rather than a silent trap.

One doc correction of my own making: I wrote that a declared platform never changes how a real signal
is treated. It does, in one case — a profile with no signal bridge installs no console cancel-key
handler either, so a real Ctrl+C during such a run takes its normal course instead of being claimed.
Said plainly in all three places that made the claim.

Two guards added for the coordinator findings; both fail against the previous code.

Release build 0 warnings. Repl.Tests 789/789, IntegrationTests 603 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6. Stress script green.

Eight lenses run locally on the current head. Six independently confirmed the four findings still open
from the last round; four new defects surfaced, three of which come from my own fixes in earlier
rounds rather than from the original design.

**A claim can outlive the owner that made it.** Disposal releases ownership before reporting a run it
could not stop — deliberately, because holding it until the scopes drain is what stranded the whole
process two rounds ago. But the abandoned scope stays in the epoch with its signal claimed, and
`Register` gated only on there being an owner, not on the epoch being clean. The next ordinary run
joined a claim nobody was draining and was cancelled by a signal nobody sent, reported as `Interrupted`
with no diagnostic naming one — from the caller's side, indistinguishable from a bug in their own
application. A claim now records its owner; one whose owner has been released is discarded, loudly,
instead of inherited.

**The readiness signal belonged to no particular start.** A single slot meant a run whose registration
wait had already given up could, when its blocked application factory finally returned, release a
*later* start — reporting a run as having joined the epoch when it had not. It is a queue now, released
oldest-first, and a start that gives up withdraws its own reservation so the late registration cannot
be paired with somebody else's.

**The task handed to callers was never observed.** `_runs` retained the raw run; the wall-clock wrapper
returned as `Completion` was retained by nothing. One of this suite's own tests deliberately never
awaits it, so a faulted task was being left for `TaskScheduler.UnobservedTaskException` on every run —
not a hypothetical caller's mistake, ours. Both are retained now: the raw one still distinguishes an
abandoned run from a finished one, and the wrapper is observed on disposal.

**PID identity, twice.** Signalling checks that the child is alive and then shells out to `kill`, and
the two cannot be made atomic without a handle the operating system keeps alive; walking a process tree
on Unix matches by id with no start-time check either. Neither has a cheap fix, so both now say so
where a consumer meets them, as the descendant-cleanup limit already did. Cancelling a signal now kills
the `kill` helper, which only a timeout did before. And `kill` is resolved from `/bin` or `/usr/bin`
rather than by bare name: started without a shell it went through PATH, so a CI step prepending a
directory decided which binary received the signal — a trust decision this package should not make for
the caller.

Documentation: `TimelineEvents` contradicted itself in consecutive sentences on an already-shipped
member, saying output is captured "at the end" where the summary and the code both put it first.
`DisposeAsync` throws and had no `<exception>` tag. Three rationales stated twice across public docs
are now stated once and cross-referenced. `ReplPlatformProfile` gets a private constructor, so the
named profiles really are the only ones. The stress script's floor says it is a floor and must be
raised by hand.

`ReplTestTimeout` collects the wall-clock timeout the session handle and the harness had each grown
their own copy of — the same reasoning that extracted `ReplTestText` earlier in this branch.

One suggestion tested and not taken: replacing the tests' `VSTHRD003` suppressions with a bare
task-returning lambda does not avoid the analyzer, which flags returning a foreign task as well as
awaiting one. The suppression stays, with the reason recorded next to it.

Release build 0 warnings. Repl.Tests 790/790, IntegrationTests 603 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6. Stress script green.

Three findings, all correct, and the second is an invariant I broke myself in the previous commit.

**A queue was still the wrong shape.** Making the readiness signal a queue fixed a slot being
overwritten, but not this: a start that gives up withdraws its own wait, yet its launch keeps running
and may register long afterwards. Oldest-first then hands that late registration to whichever start is
waiting by then, returning a run to the caller before it joined the epoch — so the next signal cancels
the abandoned run and misses the one just handed over.

Order was never something to rely on. The registration callback now carries a per-run token, taken from
the owner marker the harness sets before launching, and the harness keys its outstanding waits by it. A
late registration whose start gave up finds nothing under its token and is discarded instead of being
given to someone else. Guarded by a test that blocks two application factories to build the window; it
fails against order-based pairing.

**The orphan-claim diagnostic was written under the gate.** This class promises no consumer callback
runs while the lock is held, and `ReplSessionIO.Error` is caller-supplied: a writer that blocked there
would stop a concurrent signal callback from reaching its suppression decision. The registration-failure
path already captures and writes afterwards; this one now does the same, and the discard moved into its
own method rather than growing `Register` past the length cap.

**A scope the harness never started keeps the epoch occupied.** A command can start its own automatic
run; the owner marker flows into it, so the coordinator admits its scope — but nothing puts it in the
harness's list, so disposal can return cleanly while it is still active, and every later harness is
refused with nothing saying why. Disposal now reads the scope count before releasing ownership and
reports what outlived it. It cannot drain what it did not start; making the failure legible where it
happens is the part that was missing.

Release build 0 warnings. Repl.Tests 790/790, IntegrationTests 604 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6. Stress script green.

**A signal could be reported as handled while reaching somebody else.** Console cancel-key selection is
exclusive — `CaptureSelectionUnsafe` dispatches to the interactive handlers *instead of* the standalone
ones when any exist — so a harness created while an interactive session owned the keys would send
Interrupt into that session, cancel its command, and report `CancellationRequested` while the run under
test was never touched and went on to time out.

A green test asserting a cancellation that never happened is the worst failure this toolkit can have,
so it is refused at both points it can arise: creation, and delivery, since an interactive session can
be registered after a harness exists. Terminate is unaffected and says why — SIGTERM does not
participate in the interactive console-key priority rule.

**The guide still promised what the code no longer does.** `docs/testing-toolkit.md` said disposal kills
the process tree so a failed assertion cannot leak a running process, while the probe's own API
documentation had already been narrowed to say a descendant survives when its parent exits first. The
guide now carries the same limit.

Release build 0 warnings. Repl.Tests 790/790, IntegrationTests 605 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6.

…atch

**A drain could outlive the process it was draining.** `Process.WaitForExit()` without a token drains
by waiting for end-of-stream on the redirected handles, and a descendant that inherited them holds the
stream open until it exits — so the wait never returns, in the one method whose entire job is to honour
a deadline. The finding named the drain in `WaitForOutputAsync`; the same call sat in `WaitForExitAsync`
with the same hazard, so both are gone.

They are replaced by a bounded settle: poll the capture until nothing new has arrived for two
consecutive intervals, or until a grace that is itself clamped to the caller's deadline. That trades
the certainty of end-of-stream for terminating, which is the trade a timeout exists to make, and the
reasoning sits at the helper rather than at either call site.

**The interactive-owner refusal is now part of the dispatch.** Checking `HasInteractiveHandlersForTesting`
and then dispatching took the console coordinator's lock twice, so a handler registering in between
still took the delivery and the harness still reported it as its own. The refusal is decided from the
same revalidated selection the dispatch would have used, inside `ConsoleCancelKeyCoordinator`, and no
handler runs when it refuses — which was the point, since reporting an interactive session's result as
the harness's own is a test passing on a cancellation that never reached the run it names.

Refusal is raised rather than returned as NotHandled: the delivery did not go unclaimed, it could not
be made, and a test told "nothing happened" would look in the wrong place.

Not separately tested: the race itself. The existing guard covers the steady state, and the fix is
structural — one lock acquisition instead of two — rather than something a test can pin without
controlling the interleaving.

Release build 0 warnings. Repl.Tests 790/790, IntegrationTests 605 with 10 skips, McpTests 225/1,
Spectre 17, Protocol 6. Stress script green.