Fall back to per-process MCP cleanup on macOS

[copyberry]

Fall back to per-process MCP cleanup on macOS

Why

Signaling an MCP server's process group can fail with EPERM on macOS,
preventing owned descendants from being terminated.

What changed

• When a group signal is denied, enumerate the group's processes and signal
  members that still belong to the expected process group.
• Apply the fallback to both SIGTERM and SIGKILL during MCP stdio server
  cleanup, while retaining the existing group signaling behavior elsewhere.
• Reject invalid process group IDs and avoid signaling processes that have
  moved to another group.

Testing

Added macOS tests covering cleanup with a live or exited group leader,
SIGTERM-resistant descendants, escalation to SIGKILL, and unsafe group IDs.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}