feat(deploy): Linux OS-enforced containment backstop — PDEATHSIG/cgroup spike [SD-H]

[rickylabs]

Part of #830 (stable hardening; RFC fork OF-H). Defends the residual where a guardian is hard-killed in the same instant as the supervisor: PR_SET_PDEATHSIG via FFI or a cgroup/transient-scope realization.

• gate: hard-kill test with layer-1 (pipe watcher) disabled

Design source: PR #822 (rfc.md + plan.md rev 10, 9-cycle adversarial trail) in .llm/runs/rfc-single-deployment--orchestrator/.

[rickylabs]

Milestone 0.0.1-stable dissolved (2026-07-19). A stable release date is not forecastable with the current beta runway, and this milestone predates current issue-quality standards. This issue was verified still-relevant (not superseded in merged code), so it is preserved and re-homed to 0.0.1-beta.17 (with its parent epic #830 desktop-graph children). It retains its existing umbrella grouping (%GROUP%); no new umbrella was created because a coherent one already exists. Body baselines predating current waves are stale — re-read against HEAD before implementation.