fix(track-a): retain canonical lease through process-group cancellation

[blakinio]

Scope

Repairs the post-closeout Track A P1 found during PR #311 review: the out-of-band lock-owning supervisor must not terminate on foreground process-group cancellation while a guarded descendant is still alive.

Current implementation

• blocks normal cancellation signals across the fork race;
• installs non-terminating handlers in the dedicated child-subreaper before unmasking;
• relays a cancellation that was already pending before the supervisor existed;
• does not pass the flock FD to the guarded command;
• keeps the flock until the primary command and all adopted/orphaned descendants exit;
• adds a deterministic regression where the foreground guard process group receives SIGTERM while the guarded descendant deliberately ignores SIGTERM;
• extends the fresh acceptance-audit gate to require the cancellation-safe supervisor primitives.

No Tibia client launch/login/runtime mutation or credentials are used. PR #303 runtime-owned surfaces and Track B are untouched. Canonical :98/6082/PID/session status remains UNKNOWN/NOT_REGISTERED and the exact client fence is unchanged.

Validation is intentionally pending on this new exact head: deterministic unit, isolated Synology, fresh independent audit, repository CI and review must all pass before protected merge. A fresh manager closeout/archival will follow this corrected manager; the earlier #319 closeout is not treated as final Track A evidence after this P1.