Supervise backend process trees across platforms

[brxs]

Part of #107.

What changed

• introduces one SupervisedChild lifecycle for deck sidecars, the generation server, and model/runtime installers
• keeps Unix children in a dedicated process group and adds a syscall-only host-lifetime watchdog for abort-style exits
• creates Windows children suspended, assigns a kill-on-close Job Object, then resumes the primary thread to close the descendant race
• centralizes readiness polling, graceful/forced shutdown, timeout handling, and cached terminal status
• adds bounded 16 KiB credential-redacted diagnostic tails for failed installers
• adds child/grandchild coverage for explicit teardown, startup failure, abnormal host exit, readiness, repeated terminal polling, and diagnostic redaction

Why

The current Unix-specific helper cannot reliably own complete process trees on Windows, and raw child handles duplicate readiness and shutdown behavior across three service owners.

Validation

• Rust shell: 234 passed, 2 ignored helpers/diagnostics
• Rust engine: 109 passed
• supervisor suite: 6 passed, 1 helper ignored
• cargo clippy --workspace --all-targets -- -D warnings
• Windows Job Object module compiled successfully for x86_64-pc-windows-msvc in an isolated target harness
• git diff --check

The complete Windows app cross-check is currently blocked by a pre-existing MSVC MXCSR error in engine/src/device.rs and the host's missing llvm-rc; the parallel audio-format slice is fixing the engine error, and Windows CI will provide the full compile/runtime child+grandchild gate.

This branch was created from the same baseline as #115. After #115 merges, this PR will be rebased and its expected models.rs overlap resolved by retaining the path contract alongside SupervisedChild integration.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.