eval/E2E PTY daemons leak after temp-root deletion or interrupted runs

[myobie]

Fleet audit receipt (read-only): eval/E2E lifecycle leaves PTY daemons/children alive after temporary roots are deleted or runs are interrupted. Silber has 5 live daemons older than 20h; Hetz 13 older than 20h–4d. Their cwd and PTY_ROOT point into deleted /var/folders/.../st2e-* or /tmp/st2e-* roots and are invisible to the canonical production registry.

Required behavior: cleanup on success, failure, signal, and panic; verify no orphan daemons/children; provide a bounded evidence-preserving sweep for existing leaks. Distinct from DING CPU #22, supervisor CPU #23, and Claude classifier #26. Dead DING pidfiles on stopped supervisors are expected drift unless reconcile leaves them behind.

[myobie]

Additional exact receipt from Silber.root: five leaked fixture PTY trees were confirmed, with daemons/children surviving temporary-root deletion or interrupted eval lifecycle and remaining invisible to the canonical production registry. This corroborates the original fleet-audit evidence; no runtime mutation performed.

[myobie]

Cleanup PASS: Silber.root confirms all five fixture PTY daemon trees are absent after the authorized cleanup. No unrelated agents or runtime state were touched.

[myobie]

Follow-up: regression should cover daemon + wrapper/gate/sleep descendants and socket cleanup, not only the daemon PID. Exact pre-cleanup evidence is preserved; cleanup was authorized only for those fixtures and did not interrupt active eval execution.

[myobie]

Implemented and pushed in 6f1fe48. Fail-closed eval cleanup preserves catalogs on reap failure; PASS/judge-failure/panic/SIGTERM/SIGINT lifecycle proofs cover daemon and session-process death, empty registry, and absent pid/socket metadata. Focused tests, strict Clippy, and full cargo test --all-features pass; fmt remains a baseline-only pre-existing failure. Hosted Nix run 30419259908 passed: https://github.com/compoundingtech/st2/actions/runs/30419259908

[myobie]

Reopening with a current Darwin full-suite reproduction.

Two cargo test --no-fail-fast runs left six PTY fixture trees each: one run at 6d1d9d2 and one at a5ea782. Twelve orphaned pty-daemon processes remained in total. Each had parent PID 1 and owned one sleep 100000 child. They survived suite exit and deletion of the temporary worktree.

The process child is a safe discriminator in this observation:

• Test fixture: pty-daemon -> sleep 100000
• Live agent: pty-daemon -> st2 ... driver claude|codex --identity <id>

This evidence shows that the earlier fix in 6f1fe48 does not cover every full-suite fixture lifecycle. The affected host had no resident supervisor, so no later reconciler could remove the leaks.

The regression acceptance should include a full Darwin suite and prove zero surviving fixture daemon and sleep 100000 process trees after suite exit. It must cover successful completion and the existing failure, panic, and signal paths.