test: run destroy and reconcile live under hidepid /proc mounts and in a separate PID namespace #257

No test runs destroy and reconcile live under a /proc mounted with hidepid=2 (or 4, invisible, ptraceable), or in a separate PID namespace. Unit tests fake /proc/self/mountinfo and EPERM probes, and the lifecycle model covers the logic. A real mount was never exercised, because the development host has no root access to remount /proc.

Why it matters

Under hidepid, procHidesOtherUsers (src/host/programGroup.ts) makes an EPERM probe read a group alive, so destroy of a session whose group it cannot prove gone ends with HOST_TIMEOUT (docs/USAGE.md limit 6). That is the fail-safe side, but nothing proves it on a real mount, or in a container with its own PID namespace, where pids and autogroup ids differ from the host's.

Suggested work

• A CI job (Linux, with sudo) that remounts /proc with hidepid=2 in a mount namespace (unshare -m + mount -o remount,hidepid=2 /proc), then runs the destroy/reconcile integration tests and a live repro with another user's process in the program's group.
• A second job that runs the same tests inside a container (docker run --pid=private or unshare -p --fork --mount-proc).

Refs #222, #238

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high