Terminate complete tool index process trees

[rudijetson]

Summary

• run POSIX probes in isolated process groups and terminate the full group on completion, timeout, or nonzero launcher exit
• preserve escalation after the launcher exits, preventing npm-exec descendants from retaining CLI output handles
• add bounded Windows taskkill handling plus a creation-time-filtered descendant sweep for an already-exited launcher
• release CLI 1.10.22

Live defect

The 1.10.21 canary wrote a correct 49-stack cache but required 66.75 seconds to return because the timed-out npm launcher exited while its MCP descendant retained the output pipe.

Red-green evidence

• red: timeout launcher gone, descendant still alive
• red: launcher exit code 23 left a descendant alive
• red: simulated Windows taskkill exit code 7 left cleanup incomplete
• red: simulated Windows exited leader left its descendant alive
• green: all five focused lifecycle tests passed in five consecutive runs

Release verification

• full CLI suite: 665/665 across 43 suites
• configured debt scan: zero findings on both edited JS files
• build and git diff check pass
• npm pack dry run: 1.10.22, six files
• generated bundle hash is deterministic
• independent exact-tree review: READY

Proof limitation

Native Windows PowerShell was unavailable on the release Mac. The Windows path is covered by strict simulation that validates argv count and flags, fixed validated environment fields, exited-parent identity, helper failure handling, and descendant removal.