[T-Crypt]

Fixes #104, reported by @azrael-229.

The run's socket disconnect was the only signal that a lease ended. When the run's whole tree is killed (taskkill /F /T, a crash) and that disconnect never reaches the daemon, the lease stayed HOT with PIDS [] until a berth stop.

• Every tick checks the attached process by PID plus start time. Seen gone on two consecutive ticks, with no container named and nothing of the run still on the card or alive as a descendant, the broker releases the lease exactly as a disconnect would: lease.orphaned, then lease.released and lease.freed once the card shows it gone. With a 2 s poll that is about 6 s instead of forever.
• A reused PID (same number, new start time) counts as gone. A live process, a one-tick lookup miss, or a container lease is left alone. Nothing is signalled: Berth still never stops a process it did not start.
• Descendant sets are pruned whenever one has entries, so a dead run's children clear from its lease. With no attached run and no entries the process table is still not read.
• lease.orphaned shows as a warning in berth events and as ORPHANED in the harbor.

Tests (internal/broker/reap_test.go): dead pid released after two ticks and freed; reused PID; live pid with a lookup hiccup; container lease; a child outliving the wrapper released only after it exits.

Proof: build, gofmt, vet, go test ./..., -race -count=3 on the reaper tests, GOOS=windows build and vet, golangci-lint (0 issues).