Bind E2E server lifetime to vitest via kernel pipe-EOF

[antoninbas]

Summary

Every prior e2e run was leaving orphaned tsx src/main.ts server --port <random> processes on the host. I cleared 8 of them while deploying v0.12.0.

Two layers of fix:

1. Spawn the server in its own process group (detached: true) so we can reliably tear the whole subtree down with process.kill(-pgid, sig) on clean teardown. Previously SIGTERM went to the npx wrapper and didn't propagate to the inner node child.

2. Bind the server's lifetime to vitest via stdin-EOF, gated on KNOTES_E2E_WATCH_STDIN=1. The harness wires its own pipe to the server's stdin; the kernel closes that pipe's write end the moment the harness process dies (clean exit, SIGKILL, OOM), and the server reads EOF and exits.

   This is the canonical UNIX equivalent of Linux prctl(PR_SET_PDEATHSIG): the binding is enforced by the kernel, not by a polling loop, and the watchdog lives in the leaf process itself — no intermediary that could be killed and break the chain.

   The watchdog is a ~10 line opt-in hook in src/cli/commands/server.ts; the production server never activates it.

Also fixes the close timed out after 10000ms warning vitest printed at the end of each run.

Why not a separate supervisor process

An earlier draft of this PR introduced a small supervisor between vitest and the server that polled the anchor PID. It worked, but moved the problem rather than solving it: if the supervisor itself was SIGKILLed, the server orphaned again. The pipe-EOF approach removes that intermediary entirely — there is no Node-side process between vitest's death and the server's exit, just a kernel-managed FD.

Test plan

• Full e2e suite locally — 65/65 pass in 163s, no leaks after teardown
• Watchdog standalone test — server with KNOTES_E2E_WATCH_STDIN=1 and < /dev/null exits immediately on EOF
• Manual SIGKILL of the vitest worker mid-run — server exits within ~5s, no orphans
• CI green