child bwrap process is left as zombie

Hi! Apologies in advance if this isn't really a bug / my findings are wrong.

Bubblewrap clones itself to create a child, then clones again and exec's the user binary in this grandchild process.
I noticed that with `--unshare-pid` the parent doesn't `wait()` for the child, so the child is left as a zombie.

I *think* a fix would just look like waiting for this child, since we should be able to do that from outside the pid namespace(?).

Minimal reproduction (tested on arm64-darwin):
```shell
CONTAINER=$(docker run --privileged --detach alpine:3.22 sleep 10m)
docker exec $CONTAINER apk add bubblewrap
docker exec $CONTAINER bwrap --version
docker exec $CONTAINER bwrap --unshare-pid --dev-bind / / -- echo hi
docker exec $CONTAINER ps aux
```
This outputs
```
bubblewrap 0.11.0
hi
PID USER TIME COMMAND
1 root 0:00 sleep 10m
27 root 0:00 [bwrap] <- this is the zombie
29 root 0:00 ps aux
```

Running without `--unshare-pid` the process is cleaned up fine.

This isn't causing problems for me - I only noticed it because my container didn't have an init process to reap this zombie child. The workaround was just to run with `docker run --init` to add an init process.