[benfavre]

A completed coding provider can leave a child process holding stdout or stderr open. The worker previously waited for EOF through tee/read pipelines, retaining a busy execution slot after the provider itself exited.

Write provider output directly to the existing private spool files and follow those files only for the exact provider PID's lifetime. Wait for the provider's exit status, drain both log readers, then apply the existing completion-receipt checks. This preserves live stdout/stderr reporting and leaves child processes alive.

Stacked on #262 so the resulting release also includes the Rustls security patch.

Validation:

• Real shell execution with fake Codex, JCode and Claude providers: a still-running child inherits both output descriptors, yet the worker finishes and reports completion.
• Streaming is required before each fake provider can finish; an unterminated stderr line is retained and forwarded once.
• A nonzero provider exit remains failed even when its output contains a success receipt.
• The same inherited-output fixture times out against the original worker.
• All 247 tools tests pass; shellcheck, bash syntax, licence boundary and diff checks pass.

No live worker was stopped or restarted. Existing stranded pipelines require separately scoped operational cleanup; this change prevents the recurrence for new runs.