Reap the direct child before macOS process-group escalation

On macOS, an owned process group containing only an unreaped zombie direct child can make a later group kill return a permission error even though no live process remains. After the termination grace period, poll or wait on that direct child before escalating to the original group. Still kill surviving group members that ignored termination, and propagate genuine permission failures rather than treating every permission error as cleanup success. Reproduce the zombie-only case separately from live descendants and inspect the known group only for diagnosis. This ordering fix does not contain descendants that detach into a new session.

Applies when: A controlled coding or verification workflow uses this boundary. Keywords: macOS zombie reap killpg EPERM subprocess timeout group