refactor(supervisor): make managed child ownership structural

[elezar]

Summary

Make supervisor child lifecycle ownership structural on every platform. Linux orphan-reaper registration remains internal to the wrapper; process and SSH callers share one managed Tokio/std child API.

Related Issue

Depends on #3142.

Closes #3154

Changes

• Introduce a cross-platform ManagedChild<C> wrapper with private raw-child ownership.
• Centralize wait, try_wait, drop cleanup, and ECHILD diagnostics.
• Migrate canonical-process and SSH child spawning to the wrapper, with narrow stdio extraction methods.
• Add std and Tokio lifecycle coverage that runs on every platform; retain Linux-only reaper-race coverage.

Testing

• mise run pre-commit passes
• Unit tests added/updated (cargo test -p openshell-supervisor-process)
• E2E tests added/updated (not applicable: internal supervisor ownership refactor; fix(supervisor): serialize child registration with reaping #3142 retains the detached-fast-exit E2E coverage)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)