fix: preserve sandboxed background jobs on EPERM

[behruznassre]

Summary

• preserve live background jobs when Codex's sandbox denies a zero-signal process probe with EPERM
• keep ESRCH and other probe failures classified as not alive
• add deterministic regression coverage for both branches

Root cause

isProcessAlive() treated every process.kill(pid, 0) exception as proof that the process was dead. On macOS Codex sessions, sandbox policy can return EPERM for a live background Claude process. reapStaleJobs() then moved the job to failed; the later successful completion CAS respected that terminal state, leaving the complete review only in the log.

The zero-signal probe already sits at the correct shared boundary. This change preserves its current boolean API and recognizes the POSIX distinction: EPERM means the process exists but cannot be signaled, while ESRCH means it does not exist.

Validation

• Regression test failed before the production change and passed afterward.
• Real Codex sandbox probe: process.kill(1, 0) returned EPERM.
• Real reapStaleJobs() path with that PID retained status: running, phase: running, and no error.
• npm run check
  • 507 unit tests passed
  • 41 integration tests passed
  • 12 E2E tests passed
  • lint, typecheck, version sync, and changelog checks passed

Closes #79

[upwind-code-us]

Upwind IaC Scan - 🔍 Scan in progress…

Upwind is scanning this PR. Results will appear here when the scan completes.

[upwind-code-us]

Upwind Code Scan - 🔍 Scan in progress…

Upwind is scanning this PR. Results will appear here when the scan completes.