test(host): publish process markers atomically

[Duang777]

Summary

• centralize the Python counter-process fixture used by Host descendant cleanup tests
• publish counter updates through a sibling staged file and os.replace
• cover interruption between staging and publication with a deterministic regression test
• reuse the fixture in both generic Host and Codex CLI descendant-cleanup tests

Root cause

The Python fixtures used Path.write_text() on the published marker. Opening the marker with mode="w" truncates it before writing, so process cleanup could land in that window and leave an empty marker. The liveness assertion then compared a complete value with the empty partial state and falsely reported that the descendant survived cleanup.

Validation

• red proof: deterministic interruption test failed with assert "" == "published" under direct publication
• green proof: the same test passes with staged publication
• tests/control_plane/test_host_process.py: 7 passed
• tests/test_loopx_turn_codex_cli.py: 41 passed
• post-review focused tests: 5 passed
• Ruff and git diff --check: passed
• pre-submit code review: 3 files / 122 changed lines, no remaining P0-P2 findings

No production code or dependency lockfile changed.

[Duang777]

CI attribution for exact head 5a20d3da8:

• test-shard (1) failed test_runtime_fingerprint_rescans_when_a_snapshotted_file_disappears_while_reading: the runtime read only first.ts and later.ts, then returned without the expected retry read of first.ts.
• test-shard (2) failed test_runtime_request_source_churn_raises_a_stable_startup_diagnostic: the observed diagnostic was runtime_exited_before_ready instead of packaged_runtime_source_unstable.

Both failures are the concurrent runtime-source fingerprint race already reproduced on current main. They are unrelated to this PR's atomic Host marker change. The dedicated baseline repair is #5367 at exact head f5995f102; it validates the post-read source snapshot, retries once, and preserves the fail-closed churn diagnostic. This branch remains unchanged pending that baseline fix. No merge action was taken.

[Duang777]

Follow-up after test-shard (4) completed: it failed the third manifestation of the same baseline race, test_runtime_source_churn_has_a_stable_readiness_diagnostic, with readiness reported as ready instead of package_invalid. This is also covered by #5367. No additional Host-marker failure appeared, and this branch remains unchanged.