A cancelled run leaves no process behind: a test cancels a run mid-command and finds its whole process group gone #11229

Intent: Trust means a cancel is a cancel; nothing a run started outlives it.

Done:

• [x] a test starts a run whose command spawns a child and a grandchild, cancels it, and asserts neither is alive within 2 s
• [x] if the test fails today, the cancel path kills the run's process group, not only the leader
• [x] the run's log ends with one line saying it was cancelled, by whom
• [x] bun test passes

Files: the run-cancel module under src/crew/ or src/core/ (find it with grep for cancel), test/, docs/CREW.md if its wording changes.

Risks: signalling a group from a test must stay inside the sandbox; use the existing test helpers for processes and a short sleep, never a fixed long one.

Suggested: a builder from the Trust brief (mason or torque).

Reviewed pull #11249 at its head: ticked a test starts a run whose command spawns a child and a grandchild, cancels it, and asserts neither is alive within 2 s; if the test fails today, the cancel path kills the run's process group, not only the leader; the run's log ends with one line saying it was cancelled, by whom; bun test passes.