Fix Agent test portability and revocation timing

[AnthonyRonning]

The Agent import exposed a Windows-only path assumption in the ACP approval test and an unsynchronized timer in the Unix shell-revocation test. Use a native absolute path for the ACP fixture, and synchronize revocation after the shell parent is reaped while its same-group descendant still holds the output pipes open.

The cancellation regression now requires clean output EOF and closure of the descendant's FIFO reader. Its synchronization hook exists only in Unix test builds, is scoped to this test's future, and includes fixture-specific failure cleanup. Application behavior, dependency locks, release configuration, and the absolute-path validation rule are unchanged.

Validation:

• The synchronized test passes on macOS. A temporary mutation that disabled group termination in the post-parent-exit revocation path failed with descendant kept output pipes open; the original implementation was restored.
• Independent source review found no actionable issues.
• Pinned component just ci passed: formatting, all four Clippy feature configurations, warning-denied workspace build, and 755 tests (3 pre-existing ignored tests).
• Normal pre-commit hook passed: Research formatting/build and 818 tests.
• Hosted Windows/Linux verification is pending. The original macOS CI failure's precise cause remains unproven; one local run of the old test passed.

Follow-up to #885. Dependency advisory policy remains separate in draft #886. No official Agent release is created or enabled.