Fix bridge CI races in cancellation, deadlines and process tracking

[hetaoBackend]

Problem and resulting behavior

Shared CI exposed three races in CLI Agent Bridge:

• Expected cancellation/deadline rejections could settle before their tests registered assert.rejects, producing an unhandled rejection. The three CAS fixtures now register the assertion before releasing the asynchronous barrier and await the same assertion afterward.
• The Windows provenance test assumed a five-second overall request budget would always reach provenance setup. Slower preflight can legitimately consume that budget first. The MCP test retains the absolute deadline and no-worker assertions; a separate deterministic check advances time only after the real trace file is open and verifies deadline failure plus private-directory cleanup. The existing setup helper is exported as the test seam; its behavior is unchanged.
• Linux test-mode tracking collected child PIDs, then read their identities after scanning the parent's other tasks. Short-lived Git helpers could exit in that interval, permanently marking an otherwise completed fixture as uncertain. Newly visible children are now bound immediately, with the original parent's start identity revalidated before acceptance. Unknown children, recycled parent PIDs, and incomplete task scans remain fail-closed. This does not enable Linux production delegation, which remains unsupported; Windows Job Objects remain the supported production containment boundary.

The cross-process serialization fixture also surfaces early delegation errors instead of obscuring them with a missing-start-event timeout. No test is skipped or converted into a retry-until-success gate.

This is separate from merged Dynamic Workflow #42 and changes only CLI Agent Bridge.

Validation

• Cancellation regression: the original ordering fails a temporary fixture with a 100 ms delayed observation; the fixed ordering passes that identical probe.
• Workspace-lock tests: 26 passed, 1 Linux-only check skipped on macOS.
• Provenance cancellation/deadline/late-cleanup scenarios: 3 passed on macOS and in a Node 22 Linux container, with real filesystem operations and a controlled clock for the specific deadline boundary.
• Linux ancestry regression: a deterministic exiting-parent/child fixture fails before the change and passes after it. An additional recycled-parent test proves the candidate is not accepted. All 47 process-tree checks pass on macOS and Linux.
• Real Linux Node 22 subprocess reproduction: the original pull fixture failed with exit 0 / unconfirmed cleanup. Temporary instrumentation identified the pending-child/parent-exit branch. After the fix, the same pull scenario passed 50 consecutive executions. Temporary instrumentation is confined to /tmp and the diagnostic container, not committed code.
• Remaining Linux internal-test limitation: repeated instrumented runs still reproduce unconfirmed cleanup. The captured pending PIDs map to the local fetch transport and unpack-objects, and a separate minimal reproduction identifies automatic maintenance as another trigger. These helpers exit successfully before the tracker can bind their identities; the original parent then disappears, correctly preserving fail-closed quarantine. Immediate identity capture reduces an avoidable window but cannot guarantee observing arbitrary short-lived descendants. Thirty subsequent composite passes and fifty isolated passes do not prove this limitation fixed. The current Windows-only production support remains unchanged. A minimal direct runCommand + real Git pull probe also reproduces without MCP or workspace lease handling. Resolving the residual CI flake requires an explicit test-boundary or containment design decision; this PR is not ready to merge on green CI alone.
• Repository npm run check: 493 tests, 473 passed, 20 skipped, 0 failures. Exact-head db62086 Ubuntu validation, Windows Bridge, and CodeQL checks all passed. Those green checks do not supersede the remaining repeated-run evidence above.
• No paid model calls or real user workspace delegation. These checks do not establish support for arbitrary POSIX process escape mechanisms or change the documented supported platforms.

Failure evidence

• Main CI: unhandled cancellation rejection
• Ubuntu: missing first-backend start diagnostic
• Windows: deadline expired during preflight instead of provenance