fix: don't put bwrap in its own pgrp in argv runner

[jy-tan]

Summary

The previous unification PR put bwrap into its own pgrp via Setpgid: true to support pgrp-broadcast on the 2nd Ctrl-C. This stole the controlling terminal's foreground from sandboxed TUIs (e.g. OpenCode, Claude Code), causing them to receive SIGTTIN and stop on startup. ps showed STAT=T/Tl and TPGID != PGID for the sandboxed subtree.

Drop Setpgid on bwrap and the now-unused PgrpBroadcast/killProcessGroup machinery. SIGKILL on the 2nd signal plus bwrap --die-with-parent is sufficient to tear down the subtree. ppoll+eventfd shutdown, SIGHUP handling, drain timeout, and the unified SignalForwarder are all retained.

Changes

• internal/sandbox/runtime_exec_argv_linux.go: drop Setpgid: true on bwrap; replace killProcessGroup(...) with Process.Signal(SIGTERM) in the supervisor-died-first branch; update doc comment.
• internal/sandbox/sigproxy.go: remove PgrpBroadcast field and killProcessGroup helper (no production callers).
• internal/sandbox/sigproxy_test.go: drop Setpgid from test child and the deleted-helper test.
• cmd/fence/main.go: clean up stale comment on startCommandWithSignalProxy.

[cubic-dev-ai]

No issues found across 4 files