feat(pty): harden Unix PTY lifecycle

[decode2]

Linked issue

Closes #37

• The linked issue has the status:approved label.

Pull request type

Select exactly one option and apply the matching type:* label.

• Bug fix (type:bug)
• New feature (type:feature)
• Documentation (type:docs)
• Refactor (type:refactor)
• Maintenance or tooling (type:chore)
• Breaking change (type:breaking-change)

Summary

• Hardens Unix PTY shutdown with bounded process-group HUP -> TERM -> KILL escalation, including descendants that outlive the session leader.
• Preserves final output and trailing malformed UTF-8 at EOF, and keeps SIGINT responsive during writer-lock contention.
• Adds focused native Unix lifecycle and race regressions without changing Windows, WSL, desktop, dependencies, or later platform scope.

Changes

Area or file	Change
crates/splice-pty/src/lib.rs	Adds bounded Unix group teardown, reader-drain/output ordering, EIO-as-EOF handling, trailing lossy UTF-8 flush, and non-blocking SIGINT fallback.
crates/splice-pty/tests/unix_pty.rs	Covers resistant descendants, leader-first exit, final-output ordering, partial UTF-8, and bounded retained-slave teardown.

Test plan

• Ran the focused automated checks: cargo fmt --all -- --check, cargo test -p splice-pty (31/31), and cargo clippy -p splice-pty --all-targets -- -D warnings passed.
• Exercised the affected terminal workflow: native Unix tests cover resize, ETX/SIGINT, final output, EOF, close/Drop, process-group escalation, and writer-lock contention.
• Verified relevant platform behavior: Windows GNU compile/Clippy and Wine differential evidence passed in SDD verification; native Windows/ConPTY runtime remains a required CI gate and is not claimed by Wine.

SDD verdict: PASS WITH WARNINGS. The scoped native package checks are green. Workspace-wide tests remain blocked by the pre-existing missing apps/desktop/src-tauri/icons/icon.png.

R3-002 remains informational: writer-lock fallback signals the shell/session process group, not a separately discovered foreground process group.

Chained pull request context

Stacked-to-master delivery; each slice is independently reviewable and revertible. Prior PRs are merged.

PR1  ✅ #31 compatibility harness
  -> PR2  ✅ #34 PTY session contract
  -> PR3  ✅ #36 Unix PTY backend
  -> PR4  📍 Unix PTY lifecycle (this PR)
  -> PR5  ⏳ depends on PR4; planned next PTY slice
  -> PR6  ⏳ planned
  -> PR7  ⏳ planned
  -> PR8  ⏳ planned
  -> PR9  ⏳ planned
  -> PR10 ⏳ planned
  -> PR11 ⏳ planned
  -> PR12 ⏳ planned
  -> PR13 ⏳ planned
  -> PR14 ⏳ planned
  -> PR15 ⏳ planned

• Previous PR: feat(pty): add Unix PTY spawn and I/O #36 (merged; PR1 feat(compat): add finite AI CLI compatibility harness #31 and PR2 feat(pty): add platform-neutral session contract #34 are also merged)
• Next PR: PR5, planned PTY follow-up; depends on PR4 landing first
• Review this PR first: Unix lifecycle/group teardown, output ordering/EOF handling, and interrupt race behavior in the two changed paths
• Intentionally out of scope: native Windows implementation/certification, WSL-specific behavior, desktop integration, UI, packaging, dependencies, and tasks 3.1-4.3

Review budget: 165 additions + 20 deletions = 185 changed lines across 2 files, below the 400-line limit.

Rollback boundary: revert commit f18e59d to remove only the Unix lifecycle hardening and its focused regressions; prior PTY backend behavior remains intact.

Contributor checklist

• I searched for duplicate issues and pull requests before starting.
• I linked an approved issue using Closes, Fixes, or Resolves.
• I selected exactly one pull request type and applied exactly one matching type:* label.
• I completed every relevant template field and included reproducible test evidence.
• I updated documentation when behavior or compatibility changed. No documentation change is required for this internal lifecycle hardening.
• My commits follow Conventional Commits.
• My commits contain no AI attribution, including Co-Authored-By trailers.