feat(platform): processes that never outlive their pass, shared files, the board identity

:Process makes sure no child outlives what it was started for. SIGKILL to
the direct child alone would leave the Playwright server and Chromium
running after a timeout, and every pass running after a SIGKILLed driver:

- every child is forked by one long-lived spawner thread, the reaper's
  registry locked across fork, so PR_SET_PDEATHSIG holds and a fast exit
  is never reaped unregistered; one reaper thread owns waitpid(-1);
- the child gets an empty signal mask, SIGPIPE and SIGXFSZ at their
  defaults, and nothing but its three streams (close_range); the driver
  ignores SIGPIPE and takes SIGINT/SIGTERM/SIGHUP on a thread of its own;
- `crafter-review __supervise <argv>` is a pass's subreaper. It kills the
  pass's whole tree, Chromium's detached process group included, when the
  target exits, on SIGTERM, and when the driver dies, by its death signal.
- Run() captures both outputs without the deadlock.

The shared state the detached threads wait on is never destroyed: a
condition variable destroyed under a waiter makes glibc's
pthread_cond_destroy, and with it exit(), wait forever.

:Platform: the Flatpak sandbox decided once, the host's XDG directories
restored there; WriteAtomic and LockedUpdate, the read-modify-write of
the board, ledger, memory.json and unit-state.json every driver on the
machine shares, under flock(2) on the same side files; /proc readers; and
the identity other drivers can check: natively pid and start time, in the
sandbox the instance's host pid from bwrapinfo.json with /proc/1's start
time. The lifetime lock is created under a temporary name and renamed into
place, so no prober ever finds it unlocked while its driver lives.

Tests: Process (the three ways a pass's tree must die, return codes, a
missing program, capture, timeouts, fds, the child's signal state),
Platform (atomic writes, LockedUpdate against a damaged file, two writers,
and another process holding flock on the side file; /proc on a fake
tree; both identities; the lifetime lock; the XDG restore).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

project.cpp

@@ -13,27 +13,33 @@ using namespace Crafter;
 namespace {
     // The umbrella, then the partitions in import order: each after the ones
     // it imports, which is also the order the module map in AGENTS.md uses.
-    constexpr std::array<std::string_view, 7> Interfaces = {
+    constexpr std::array<std::string_view, 9> Interfaces = {
         "interfaces/Crafter.Review",
         "interfaces/Crafter.Review-Unicode",
         "interfaces/Crafter.Review-Json",
         "interfaces/Crafter.Review-Text",
         "interfaces/Crafter.Review-Crypto",
+        "interfaces/Crafter.Review-Platform",
+        "interfaces/Crafter.Review-Process",
         "interfaces/Crafter.Review-Core",
         "interfaces/Crafter.Review-Driver",
     };
-    constexpr std::array<std::string_view, 4> Implementations = {
+    constexpr std::array<std::string_view, 6> Implementations = {
         "implementations/Crafter.Review-Text",
         "implementations/Crafter.Review-Crypto",
+        "implementations/Crafter.Review-Platform",
+        "implementations/Crafter.Review-Process",
         "implementations/Crafter.Review-Core",
         "implementations/Crafter.Review-Driver",
     };
 
     // One per directory under tests/, each an ordinary main() that links the
     // library: exit 0 passes, nonzero fails, 77 skips.
-    constexpr std::array<std::string_view, 2> Tests = {
+    constexpr std::array<std::string_view, 4> Tests = {
         "Crypto",
         "Text",
+        "Platform",
+        "Process",
     };
 
     // The version the binary reports: CI sets it from the tag, a checkout