Harden Desktop lifecycle deadlines and persistence

[yyjeqhc]

Summary

• introduce one absolute Desktop deadline per readiness/CLI operation and bound cleanup separately, without resetting business timeouts across nested work
• move Desktop-owned Server/Runner/QuickShare/Tunnel process-tree authority to webcodex-process::ManagedChild on Unix/macOS and Windows Job Objects
• add explicit Desktop-only --stop-on-stdin-eof parent-liveness opt-in for Server/Runner and foreground share/tunnel paths
• make Desktop state persistence recoverable with same-directory atomic replacement, previous-known-good backup, explicit recovery, and fail-closed corruption handling
• bound machine stdout buffering, coalesce/drop only progress, retain terminal/readiness priority, and explicitly surface critical event overflow

Independent review

Reviewed after #306 was squash-merged to current main. The D4 branch still merges cleanly with current main (git merge-tree --write-tree succeeded), so no rebase/reset was needed.

The review found one small correctness gap: the bounded machine-event channel generated machine_event_overflow, but the Quick Share and Regular Tunnel readiness consumers ignored that synthetic event while waiting only for ready. Reviewer commit 253be5e8 now fails closed on critical overflow, reclaims the exact owned process within bounded cleanup slack, and returns explicit machine_event_overflow details instead of silently consuming the signal.

Validation

Implementation handoff:

• Desktop Rust: 40 passed, 0 failed, 3 ignored
• webcodex-process: 17 passed, 0 failed, 1 ignored stress test
• cargo check --all-targets -p webcodex-runner passed
• cargo check --all-targets -p webcodex passed
• Desktop frontend tsc -b && vite build passed
• Windows x64 and macOS arm64 webcodex-process --tests cfg compile passed

Fresh reviewer after the overflow fix:

• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --lib — 40 passed, 0 failed, 3 ignored
• Desktop cargo fmt -- --check — passed
• git diff --check and staged check — passed
• merge-tree against current origin/main — clean

No deploy or branch-protection changes.