v0.2.2

Closes #13.

Process cleanup safety

AgentShell no longer stores numeric process-group IDs and later tries to infer whether they still
belong to an AgentShell child. A reaped PID can be reused by Linux, so that design could send
SIGKILL to an unrelated process group.

Each agent execution now uses a dedicated process-group guardian:

• AgentShell owns the guardian through a private pipe, an exact kernel object that cannot be
  confused with a recycled PID.
• Cancellation, abandoned streams, model-discovery cleanup, and interpreter exit ask the guardian
  to kill its own group.
• Normal stream completion releases the guardian without killing processes intentionally left by
  the CLI.
• If the guardian has already died, cleanup fails safe and accepts a possible leak rather than
  signalling a numeric process-group ID.
• Guardians close inherited file descriptors and redirect their own output to /dev/null.

All six adapters and every model-discovery path now use the same ownership-safe mechanism.

Tests and review

• Added real-process lifecycle coverage for all six adapters through normal completion,
  cancellation, and stream abandonment.
• Added kernel-level coverage for child/grandchild cleanup, dead-guardian failure, interpreter
  disappearance, already-reaped CLIs, model-discovery cleanup, and file-descriptor isolation.
• Full local suite: 784 passed, 2 skipped.
• Process-lifecycle suite passed 10 consecutive stress runs.
• Wheel and source distribution builds verified.
• Reviewed twice by Claude Code Opus at maximum effort with no blocking findings.