Fix Linux signal stderr cleanup

[yihanzhu]

Follow-up to #207.

Unblocks #206.

Repeated TERM exposed two Linux Bash signal races. First, changing live signal traps while TERM was pending made Bash write an internal warning. Second, a signal sent to the whole runner process group could kill polling or cleanup commands before the runner finished reaping children and removing scratch state.

This keeps one permanent guarded signal handler and does not change its live trap table. Cleanup now tolerates interrupted waits and sleeps, retries removal for a bounded time, covers dangling links, and fails closed if final removal cannot finish. The one-second child timeout now uses a private unlinked pipe and a Bash built-in wait, so a group signal cannot kill a polling sleep or leak a job message. The adapter cannot reopen the pipe and closes its inherited descriptor.

The regression starts the runner in its own process group, proves a registered child group is live, and sends TERM to the whole runner group at least twice. It still requires exit 143, empty stdout and stderr, no scratch, and no surviving child. Failure output reports only counts, SHA-256, and fixed classes.

Proof on 50b24b5:

• portable adapter contracts: 29 focused checks passed within a 900-second hard timeout
• ShellCheck 0.11.0 passed on both changed shell files
• bash syntax checks passed
• git diff check passed

This is inactive, repo-only test-runner behavior. It does not use a real target, credential, network adapter, release, install, activation, or deployment.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: cfd0218
Reviewed-base: 77eedf9
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/208-57628/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The patch avoids the Bash trap-table mutation but weakens cleanup under repeated process-group signals, potentially leaving child processes and scratch state behind.

Review comment:

• [P2] Keep cleanup resilient to process-group signals — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.uiiETj9vYm/adapter-tests/v1/runner.sh:67-67
  When the runner is stopped by a process-group signal, such as Ctrl-C or a CI timeout, and another HUP/INT/TERM arrives during terminate_active_group or cleanup, removing the ignored dispositions means /bin/sleep and /bin/rm spawned by the trap inherit the default disposition and can be killed by that group signal. With set -e, signal_exit can then abort before the KILL pass or rm -rf, leaving the adapter's separate process group and scratch directory behind; SIGNAL_EXITING protects only the shell, while the test sends signals only to $signal_pid and misses this case. Preserve signal immunity for cleanup subprocesses without mutating Bash's live trap table.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	50b24b5
Status:	✅  Deploy successful!
Preview URL:	https://769e9815.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-fix-adapter-signal-std.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 50b24b5
Reviewed-base: 77eedf9
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/208-82735/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The changes preserve the runner's timeout and descendant handling while making signal cleanup more robust. The updated focused test appropriately exercises repeated process-group termination and cleanup behavior.