fix(cli_control): harden process kill and error paths

[mkoura]

• trust start script PID only while instance is starting; a finished start leaves a stale PID that the kernel may recycle
• reject PID <= 0 from pidfile; 0 or negative would signal the whole process group
• escalate SIGTERM -> SIGKILL with bounded waits instead of a blind 0.5s sleep; report a survivor as failure
• catch OSError from Popen in start/stop/restart helpers; a script without exec bit was an unhandled traceback
• undelay instance in finally; a raised exception used to leave the delay file behind and abort the whole stopall loop
• check running state only while the instance is delayed (TOCTOU)
• validate action flags and supervisorctl presence before delaying
• tolerate malformed testnet.json in ls; warn instead of crashing
• shlex-quote sourced env values; unquoted workdir path could break quoting or execute command substitution
• pass argv lists to run_command; str splitting broke on workdir paths with spaces
• remove stale pidfile also on foreground start

[Copilot]

Pull request overview

This PR hardens the testnet CLI control/create flows to avoid unsafe PID signaling, improve process termination reliability, and make command execution and instance listing more robust in the presence of malformed/missing files.

Changes:

• Adds PID validation helpers and a bounded SIGTERM→SIGKILL escalation path when stopping “starting” instances.
• Switches command execution to argv lists (avoids .split() issues on paths with spaces) and expands error handling for OSError.
• Quotes exported environment values for safe shell sourcing and makes ls resilient to malformed/missing testnet.json.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/cardonnay/cli_create.py	Quotes sourced env values, uses argv lists for run_command, and adjusts PID file handling for start paths.
src/cardonnay/cli_control.py	Implements PID validation + safer kill logic, hardens stop/restart execution paths, improves ls robustness, and refactors action/delay handling.

Suppressed comments (1)

src/cardonnay/cli_control.py:302

• The earlier guard against negative instance_num was removed. With a negative value, delay_instance() will create a delay_stat-<n> file, triggering warnings in get_delay_instances() and potentially interfering with instance coordination. Reject negative instance numbers up front.

    workdir_pl = ca_utils.get_workdir(workdir=workdir).absolute()

    if not (stop or restart or restart_nodes):
        LOGGER.error("No valid action was selected.")
        return 1

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.