fix(process): isolate execution ownership and bound output

[ttbombadil]

Summary

• Give every execute() invocation its own process ownership, deadline and settlement cleanup.
• Keep other executions owned when a sibling closes or errors; signal all owned children with their actual detached setting.
• Cancel requests stopped while awaiting the spawn-module import.
• Bound combined captured raw stdout/stderr with a positive per-call budget, defaulting to the existing 100 MiB resource budget. Overflow terminates only its owner and cannot report success.
• Remove settled output listeners; preserve diagnostic redaction and the existing result shape.

Reproduction and review

Base: freshly fetched origin/main 221b83b9b248ab524c299ffe0e7ac890f23d7dcc after successful post-merge CI for #186.

Deterministic RED/GREEN regressions cover a sibling's lost timeout, lost busy/kill ownership, detached process groups, pending pre-spawn stop, combined output overflow, exact boundaries, UTF-8 byte counting, bounded diagnostic prefix, late output and invalid budgets.

An independent reviewer reproduced the pre-spawn stop race with real echo; its fix is covered by an additional RED/GREEN regression. No other important findings.

Limit scope: the budget counts raw captured/forwarded bytes. A truncated UTF-8 sequence may render as a replacement character in diagnostics; changing the existing decoding semantics is deferred. Callback reentrancy and broader LocalCompiler filesystem/retry cancellation are outside this executor patch.

Verification

• Focused executor/compiler suites: 44 passed.
• Full unit/coverage and local Sonar quality gate.
• Type/docs checks, non-fixing ESLint (existing warnings only), complete build.
• Real toolchain integration, full Docker integration and full Chromium E2E.
• Normal commit and pre-push gates, no bypass.

No Provider calls, SSOT/ADR changes, Tutor/Planner/Mastery/Prompt changes, or changes to existing protected/untracked local documents.