Implement native non-PTY processes

[pcarrier]

Summary

• implement feature bit 13 and the native non-PTY process packet family, plus transport-neutral Rust command/child/list/watch helpers
• give every started child a public, server-boot-scoped process_ref; any process-capable client can list live children and TTL-retained detachable final records, attach concurrent watches for future output, and issue lifecycle controls through a watch without a bearer/adoption token
• inherit the complete server process environment, with client-supplied entries overriding matching inherited keys; there is no CLEAR_ENV mode
• provide independent per-watch output credit, an explicit single stdin-writer request, TTL-retained exit metadata for detachable children without stdout/stderr replay, and owner-bound lifetime for ordinary children
• enforce endpoint, generation, watcher, request, stream-window, and process-outbox limits; close stalled/overflowed endpoints instead of silently dropping committed process frames
• contain Unix children in process groups and Windows children in kill-on-close jobs, with residual-tree cleanup, shared-reaper integration, descriptor hygiene, bounded per-process termination and cleanup waits, and Windows lifecycle CI
• integrate feature negotiation, disabled-family replies, fair bulk scheduling, BLIT_PROCESS=0 / --no-processes, startup policy settings, and operator/RFC documentation

There is intentionally no cross-client process confidentiality or control boundary: process-capable clients can discover, watch, and control one another's native children. The low-level packet/accounting API is included; integrated native-client and extension convenience SDKs remain follow-up work.

Validation

• cargo test -p blit-server --lib — 484 passed
• cargo test -p blit-remote --lib — 240 passed
• cargo test -p blit-cli --bin blit — 93 passed
• ./bin/lint --check — Rust formatting, Prettier, and the full clippy matrix passed
• post-merge audit found a test-only shared-reaper bookkeeping race in the descriptor regression; fixed in Fix native process descriptor test reaper race #286

[indent]

PR Summary

Adds a native, non-PTY child-process family (feature bit 13, opcodes 0xC0–0xC7) so clients and extensions can run programs directly (no shell, no terminal) with binary-safe argv/env/stdio, independent per-stream flow control, and Unix process-group / Windows kill-on-close-job lifecycle. This revision reworks the model from the earlier detach/adopt-token scheme into a public, server-boot-scoped process_ref catalog with concurrent multi-watcher streaming.

• Public catalog + watchers: every started child gets a nonzero 64-bit process_ref; any process-capable endpoint can PROCESS_LIST the catalog and PROCESS_WATCH a child (new 0xC6/0xC7 opcodes replace ADOPT). There is no per-client privacy or control boundary.
• Single stdin writer: exactly one watch writes stdin; the creator starts as writer and the role is atomically reacquired by the next PROCESS_WATCH(STDIN) after the writer unwatches or disconnects. Losing racers receive an ACK and never disturb the child or cursor.
• Isolation of slow consumers: each watch has its own stdout/stderr windows; a lagging watch (or a stalled guarded lifecycle frame past the 10s deadline) closes only its own endpoint rather than stalling the child or peer watchers.
• Lifecycle & retention: ordinary children die with their creating endpoint (peers get an OWNER_LOST exit); detachable children survive with zero or more watchers and retain a compact, publicly watchable final result for a TTL. PROCESS_EXIT fans out to every watcher under its local id.
• New caps: BLIT_PROCESS_MAX_WATCHERS (global) and BLIT_PROCESS_MAX_WATCHERS_PER_CHILD (64), plus the existing per-endpoint/global generation, request-byte, buffer, and bounded per-endpoint outbox limits.
• Environment: children now inherit the full server environment with client-supplied overrides (documented as intentional parity with PTY children); the earlier baseline-allowlist/CLEAR_ENV was removed.
• Enabled by default; disable with BLIT_PROCESS=0 or blit server --no-processes. Adds Windows CI coverage for the process tests.

Issues

All clear! No issues remaining. 🎉

1 issue already resolved

• A detachable process that exits during the detach draining window (after PROCESS_CONTROL(DETACH) is accepted but before the cutoff reply is written to the old endpoint) loses its retained final result: try_queue_terminal calls release_record, removing the adopt token, so a later PROCESS_ADOPT returns NOT_FOUND instead of the frozen EXITED snapshot. (fixed by commit 8c24c72)

_{View session}

[github-actions]

Coverage

Crate	Lines	Functions	Regions
alacritty-driver	73.5% (837/1139)	76.4% (68/89)	77.0% (1360/1767)
browser	0.0% (0/822)	0.0% (0/68)	0.0% (0/1401)
cli	25.8% (2621/10152)	37.3% (320/857)	28.0% (4341/15517)
compositor	33.4% (5574/16692)	47.4% (457/965)	33.2% (7635/22993)
desktop	73.0% (1704/2335)	65.0% (147/226)	68.7% (2440/3550)
fonts	85.3% (756/886)	89.9% (71/79)	86.4% (1485/1719)
fssync	92.5% (5514/5961)	94.4% (501/531)	92.7% (10180/10981)
gateway	30.9% (498/1610)	34.2% (50/146)	26.2% (697/2663)
git	87.6% (4435/5060)	89.6% (360/402)	87.4% (7066/8082)
lsp	77.4% (2688/3471)	79.4% (262/330)	75.2% (4210/5595)
proxy	19.2% (172/898)	20.5% (26/127)	21.0% (293/1392)
remote	91.1% (12431/13652)	93.3% (898/962)	88.9% (20550/23111)
sd-notify	73.9% (68/92)	100.0% (6/6)	83.2% (109/131)
server	54.4% (16134/29655)	66.1% (1446/2188)	55.8% (25798/46194)
ssh	32.2% (165/512)	48.2% (27/56)	31.4% (261/830)
upsidedown	31.4% (391/1247)	27.8% (55/198)	34.8% (797/2287)
webrtc-forwarder	7.2% (198/2765)	10.3% (21/204)	5.3% (243/4549)
webserver	64.4% (1239/1924)	67.5% (172/255)	66.6% (2090/3138)
Total	56.1% (55425/98873)	63.6% (4887/7689)	57.4% (89555/155900)