fix: reap owned gateways and honor scheduled restart attempts

[brainx]

Summary

Stopping a restarted bot could wait for an older cached process, then clear the live process's state. Match cached handles to the requested PID and reap owned children before probing liveness so exited children cannot block recovery.

Allow an already-counted scheduled restart to run when it is the final permitted attempt. Drain API fixture workers before removing test state to prevent access-log writes racing directory cleanup.

Test Evidence

• Independent branch: 69 tests passed across gateway runtime, lifecycle regressions, intent recovery, lifecycle locking, stop escalation, and restart-limit/backoff cases.

• Command: python -B -m unittest -q tests.test_gateway_runtime tests.test_lifecycle_regressions tests.test_intent_recovery tests.test_lifecycle_lock tests.test_supervisor_cli_api.SupervisorCliApiTests.test_supervisor_stop_can_escalate_to_sigkill_after_timeout tests.test_supervisor_cli_api.SupervisorCliApiTests.test_reconcile_force_and_reset_restart_attempts_now tests.test_supervisor_cli_api.SupervisorCliApiTests.test_reconcile_schedules_and_restarts_with_backoff tests.test_supervisor_cli_api.SupervisorCliApiTests.test_reconcile_honors_restart_limit

• Scoped Ruff, formatting, mypy, and git diff --check passed.

• make check passed on the combined six-fix checkout: 1,314 tests in each test/coverage pass, three environment-dependent skips, 82.61% branch-inclusive coverage. Repository contracts, formatting, Ruff, mypy, Bandit, and ShellCheck passed.

• The API authentication regression passed with the draining fixture. Latest-head GitHub CI passed across Python 3.11–3.14, Linux/macOS lifecycle, real Docker isolation, pinned Hermes, and package verification.

Risk

Changes process-liveness and restart scheduling decisions. Existing ownership and PID-reuse checks remain in place; regressions cover stale cached handles and reaping an actual exited child. No schema or configuration changes.