refactor: unify SIGINT/SIGTERM forwarders and add SIGHUP handling

[jy-tan]

Summary

The outer fence and the argv-mode runner had two near-duplicate signal forwarders that diverged subtly. Extract the shared pattern into a single SignalForwarder (one place to reason about, one place to test) with a PgrpBroadcast flag and an OnEscalate callback making the divergence explicit. Both forwarders now also catch SIGHUP, so closing the terminal triggers clean teardown instead of relying on bwrap --die-with-parent.

Changes

• New internal/sandbox/sigproxy.go: SignalForwarder with idempotent stop, 1st/2nd/3rd-signal escalation, optional pgrp-broadcast, optional OnEscalate hook. killProcessGroup lives here now.
• cmd/fence/main.go: startCommandWithSignalProxy is now an 8-line wrapper.
• internal/sandbox/runtime_exec_argv_linux.go: startLinuxArgvExecSignalForwarder is now a wrapper with PgrpBroadcast: true, OnEscalate: shutdown.Begin.
• internal/sandbox/sigproxy_test.go: 8 unit tests; the dispatch loop is exposed as run(sigChan, done) so tests drive signals deterministically without the global OS handler.

Behavior changes

• SIGHUP now participates in the escalation. Previously uncaught.
• Outer fence still Process.Kill()s on 2nd signal (no pgrp broadcast) - bwrap isn't always in its own pgrp there. Pgrp-broadcast on the outer fence is deferred to a follow-up.

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/sandbox/sigproxy_test.go">

<violation number="1" location="internal/sandbox/sigproxy_test.go:60">
P2: Avoid fixed `time.Sleep` synchronization in these tests; wait deterministically for the queued signals to be consumed (with a timeout) before asserting or stopping the goroutine.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}