exec can orphan the child process tree when halted during acquisition

[taras]

Problem

exec from @effectionx/process@0.8.1 can leave the child process tree running with no owner when the calling scope is halted during acquisition. createPosixProcess spawns the OS process and then suspends several times — two fromReadable resources and four spawns — before registering the ensure that signals the process group and joins stdio EOF. A halt landing on any of those suspension points discards the pending instructions, so the kill-ensure never registers and the child runs to completion as an orphan.

This was one of the two causes of #417: an orphaned deno bundle wrote its output into a scratch directory after the scope's cleanup had already removed it.

Two smaller defects sit in the same teardown:

• The catch (_e) { /* process is probably already dead */ } around process.kill(-pid, "SIGTERM") also swallows the join: when the kill throws, the all([stdoutDone, stderrDone]) wait is skipped entirely, so teardown can return while the tree is still winding down.
• On macOS, killpg on a process group whose members are all zombies fails with EPERM, not ESRCH (verified empirically on Darwin 25.5.0). Code distinguishing "already dead" from "not permitted" by errno misclassifies this case.

What the repository does meanwhile

scripts/lib/contained-run.ts (from the #417 fix) registers the terminate-and-join teardown before the process exists and creates the process in the same synchronous continuation, so no halt can separate acquisition from release. The bundler is its only consumer; every other exec call site still has the upstream window.

Acceptance

• @effectionx/process registers the child's termination with no suspension point after the process is created, or upstream ships an equivalent guarantee, and the pinned version here carries it.
• scripts/lib/contained-run.ts is retired in favor of the upstream primitive, its tests migrated to whatever pins the upstream contract.

[taras]

thefrontside/effectionx#230 (configurable shutdown policies, fixing effectionx#228) is adjacent but does not close this: it fixes teardown stranding on the close-settled join when a descendant holds inherited stdio — the complement of what happened here, where teardown was never armed at all. In its diff, createPosixProcess still spawns the child early and registers the kill-ensure at the end of the eval body (it even adds one more spawn, the exit watcher, before it), so the halt-during-acquisition window is unchanged.

One constraint for the migration acceptance: contained-run.ts deliberately relies on the close-settled join as its barrier — the esbuild service inherits the bundler's stderr, so joining close after the group SIGTERM is what guarantees the tree is gone before scratch cleanup. #230's graceful default preserves that (kill(-pid) then wait for closure), but an exited()-settling or forced policy returns teardown before descendants die and would reintroduce the late-write window. Migrating back to upstream exec must keep the group-signal-then-join-closure ordering.