macOS sandbox blocks ps-backed recording process identity

## Purpose

Allow iOS simulator recording to establish and verify process ownership inside a macOS sandbox that refuses execution of `/bin/ps`.

## Reproduction

Run a synthetic Node child-process identity query under `sandbox-exec -p '(version 1)(allow default)'`. On macOS where `/bin/ps` is setuid, its execution is refused. `readProcessStartTime` and `readProcessCommand` return null, and recording startup can fail with `simctl recordVideo did not expose a complete process identity`.

The shared host-process module currently shells out to ps. A non-privileged native probe using `proc_pidinfo(PROC_PIDTBSDINFO)` and `sysctl(KERN_PROCARGS2)` can read the same owned child under this policy. `PROC_PIDTBSDINFO` needs a nonzero argument to include zombie processes.

## Required behavior

- Keep command/start-time ownership checks and fail closed when identity cannot be proven; do not replace ownership with PID liveness alone.
- Bound native reads and preserve argument boundaries before rendering the existing command string.
- Detect changed start identity, zombie state, permission refusal, and exited processes.
- Package the native implementation without a global installation and keep non-macOS behavior unchanged.

## Completion evidence

Real sandbox tests on synthetic owned children, malformed/bounded parsing tests, and iOS recording start/stop with a nonempty playable artifact. No benchmark transcripts or private run results are needed.