DGC tells a live peer from a dead one by checking that the process behind a recorded
pid is still the process that wrote the note. It read that identity from
/proc/<pid>/stat -- which macOS does not have. So on every Mac the read failed,
_proc_start returned empty, and liveness() fell through to 'unknown' for every peer:
a note left by a dead session was indistinguishable from a live one's, and the
concurrent-sessions work quietly did not work there.

It asks ps for the start time on Darwin now, with a timeout so a wedged ps cannot
stall a peer check. That child's stdin is closed rather than inherited: under
dgc serve this process's stdin is the editor protocol pipe, and the suite's own
stdin-isolation guard caught the first version of this fix for exactly that.

This is also why the Release workflow was 'chronically red, each tag failing a
different macOS test' -- three test_peers failures on every macOS job, on every tag.

Also: the capture harness no longer refuses an Ollama :cloud model. A cloud model is
never resident locally, so the residency check -- there to stop a capture pulling
weights mid-recording -- rejected the one model that has nothing to pull, forcing
captures onto whatever local model happened to be warm.