Native client and MCP process trees survive after Pentect is SIGKILLed

## Problem

Pentect starts native clients with a plain child process and relies on normal Rust Drop cleanup. If the Pentect parent is killed with SIGKILL, the gateway and memory store stop, but the real client process tree can remain alive.

This leaves a half-dead session: the client still has a loopback gateway URL that no longer exists, while local tools and MCP servers may continue running with the user's permissions.

## Confirmed reproduction

Tested on current main-equivalent tree and Pentect v0.0.72 code, Linux, Codex CLI 0.153.0, and tmux 3.7b:

1. Start a real Codex TUI through Pentect in an isolated tmux server.
2. Record the Pentect, Codex, and MCP descendant PIDs without printing environment values.
3. Send SIGKILL to the Pentect parent only.
4. Wait five seconds and inspect the exact recorded PIDs.

Observed:

- the Pentect gateway and memory-store process are gone;
- Codex is reparented and still alive;
- its node/MCP descendants are still alive;
- Codex retains the now-dead loopback gateway URL in its command line.

A fake client that ignores signals and starts a child reproduces the same direct-child survival. Normal Ctrl-C does clean up the tested tree, so this is specifically an abnormal-parent-death gap.

## Root cause

crates/pentect-cli/src/main.rs:2330-2382 uses Command::spawn and only calls Child::kill after the normal interrupt grace period. It neither owns a process group/job nor installs a parent-death mechanism. Guard cleanup at main.rs:2590-2600 cannot run after SIGKILL.

This is related to the general lifecycle goal, but it is not the Windows broker race fixed in #1042 and is not covered by the desktop-only scope of #352.

## Impact

Terminal or tmux loss, OOM kill, kill -9, and supervisor failure can leave supported agents and their MCP/tool descendants consuming resources or continuing local work after Pentect's protection infrastructure is gone. A restart does not adopt or terminate the stale tree.

## Acceptance criteria

- Treat the entire native client tree as one lifecycle unit on Linux, macOS, and Windows.
- Ensure descendants terminate when the supervising Pentect process dies abnormally, including the spawn/setup race.
- On normal interrupt and startup/error paths, terminate and reap the full tree rather than only the direct child.
- Add deterministic fake-client E2E coverage for parent SIGKILL and nested descendants.
- Add at least one real-client Linux check that confirms the client and MCP descendants are gone.
- Keep interactive terminal behavior and exit-status forwarding unchanged.
- Document platform-specific guarantees where the OS cannot provide identical semantics.

## Evidence safety

All testing used synthetic content. Recorded environment values and private paths are intentionally omitted.

Start in crates/pentect-cli/src/main.rs:2330-2382 and review the cleanup guard at lines 2590-2600, then reproduce the fake-client parent-SIGKILL case with nested descendants. Design platform-specific process-tree ownership and cleanup for abnormal and normal exits, while preserving terminal behavior and exit-status forwarding. Done includes deterministic fake-client E2E coverage and the required real-client Linux check.

Written by the indexing model from the issue text.