fix(resenv): correct worker shutdown and PR artifact verification

[titan-ron]

When resenv run wraps a command that starts a worker, signaling only the immediate command can leave that worker running and hang shutdown. Forward POSIX shutdown signals to the command's isolated process group, preserving direct child signaling on Windows and tolerating groups that have already exited.

PR builds check out the head commit, while GitHub's GITHUB_SHA identifies a synthetic merge commit. Verify candidate identity against the actual checkout so all matrix jobs can test the same archive without weakening the source-commit or integrity checks.

Allow up to four minutes for GitHub to process PR coverage after the observed 160-second timeout; upload and processing failures remain blocking.

Extend the existing three-signal regression to cover both the command and its worker. Align maintainer instructions with requested PR delivery through a temporary task branch, and record the decision to skip live Doppler account approval.

Validation on Node 24.19.0:

• The expanded shutdown regression reproduced the hang before the fix and passes afterward for SIGINT, SIGTERM and SIGHUP, each delivered once.
• npm run verify: lint, strict types, build, 101 unit/tooling tests, 41 process tests, 16 packed runtime checks and two typed consumers passed.
• The exact hosted candidate passed with a simulated PR merge SHA; a candidate from the wrong source commit remained rejected.
• npm run audit: zero runtime findings; the 12 bounded development exceptions and November 9 expiry remain unchanged.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/vitest

The overall line coverage in commit b02d668 in the titan/forward-child-... branch remains at 95%, unchanged from commit 119d5b5 in the beta branch.

---

_{Updated October 13, 2026 12:15 UTC}