fix(tmux): kill process groups; flush cwd+listener sweep; status wrong-owner check

[hefgi]

Fixes #30 — orphaned descendants of tmux-spawned services survive ecluse down and ecluse flush, silently colliding with future sessions.

What's wrong

In tmux mode, ecluse down runs tmux kill-session, which only sends SIGHUP to each pane's foreground process. Any multi-level child tree — sh → pnpm → node → vite, plus anything that calls setsid() like workerd — reparents and survives, ending up adopted by launchd/init while still holding its ports. After a few up/down cycles those orphans accumulate. The next ecluse up silently lands a new service on a port already held by a zombie, so the user's browser ends up serving a different worktree's content. ecluse status doesn't notice — the recorded PID is still alive and something is bound to the port, so it reports ✓ up.

ecluse flush inherits the same defect. The nohup path was already correct (fixed in PR #18 with kill_process_group + TERM→KILL grace) — tmux just never got the same treatment.

What changed

1. kill_tmux now group-kills every pane (commit 1). Before tmux kill-session, enumerate every pane PID via tmux list-panes -s -t <session> -F '#{pane_pid}' and signal each as a process group through the existing kill_process_group helper. Same TERM→KILL grace (2s) as the nohup path. New unit test mirrors kill_nohup_kills_whole_process_group — a service that launches a sleep & echo $! > child.pid; wait background child must have the child dead after kill_services.

2. ecluse flush sweeps cwd and listener ports (commit 2). Two new steps between docker compose down and worktree removal:

• cwd sweep: for each subdirectory under worktree_dir, list every PID with a file open inside it (lsof +d via the existing sync::pids_in_directory) and group-kill it. Skips flush's own PID so the command doesn't suicide.
• listener sweep: enumerate every base_port + slot*slot_stride and extra_ports[].base_port + slot*slot_stride across all max_slots, call validate::port_listener(port) for each, group-kill any listener PID found.
  The flush confirmation prompt warns that editors/shells with files open in worktrees will be killed; --yes is unchanged for CI.

3. ecluse status flags wrong-owner ports (commit 3). New listener-identity check for every managed native service: if port_listener(port) returns a PID that's neither the stored PID nor a descendant of it (via the existing whose_pid::is_descendant), the service is reported as ✗ wrong owner (PID N) instead of healthy. JSON output gains listener_pid and wrong_owner fields. Exit code semantics unchanged — wrong-owner trips the existing exit 1 path. Six new tests cover the four-way state matrix (managed × healthy × wrong-owner combinations, including the precedence rule that wrong-owner wins over healthy=true).

4. Docs (commit 4): CHANGELOG [Unreleased] entries citing #30, a new SKILL.md troubleshooting subsection (Wrong content served on the configured URL after multiple up/down cycles), and an updated docs/src/limits.md process-management section.

Visibility changes

• sync::pids_in_directory — private → pub(crate) (used by flush)
• whose_pid::is_descendant — private → pub(crate) (used by status)
• process::kill_process_group_with_grace — new pub wrapper around the existing module-private kill_process_group so main can drive group-kills

No new config surface. No state.json schema change. JSON output gains two additive fields. Behavior delta for tmux users: services spawned via ecluse up now actually die on ecluse down — which is the documented contract.

Verification

cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test --bin ecluse (446 unit tests passing — 6 new) all green locally.

Manual reproduction of the bug report against the fixed binary:

# In a pnpm-based monorepo:
ecluse up feat-a; ecluse up feat-b; ecluse up feat-c
pgrep -fl 'vite.js --port' | tee before-down.txt
for s in feat-a feat-b feat-c; do ecluse down "$s" --keep-worktree; done
pgrep -fl 'vite.js --port'   # should return nothing

# Verify status wrong-owner detection:
ecluse up feat-foo
# Kill its tracked PID by signal only (not its descendants), then bind something else on its port:
nc -l 7301 &
ecluse status feat-foo
# Expected: ✗ wrong owner (PID <nc-pid>)

Test plan

• ecluse down (tmux) kills pnpm wrapper chains end-to-end
• ecluse flush --yes reaps setsid()-detached children with cwd in any worktree
• ecluse flush --yes kills any listener on base_port + slot*slot_stride for every slot
• ecluse status flags a hijacked port as ✗ wrong owner (PID N), exit 1
• ecluse status --json includes listener_pid and wrong_owner for native services
• CI green (clippy --all-targets, fmt --check, test --bin ecluse)