[stack 36/39] Reap review agents on shutdown

[sarthakagrawal927]

Outcome

Closes the independent Claude review finding that native cancellation could terminate the Rust CLI parent while leaving its separately grouped Claude or Codex reviewer alive.

Changes

• intercept Unix SIGINT and SIGTERM in the codevetter CLI
• mark every review owned by the CLI process as cancelled
• wait for the existing process-group kill and reap path before exiting
• preserve conventional exit codes 130 and 143
• add focused cancellation and signal-exit tests

Evidence

• independent Claude Sonnet review: one high-severity cancellation finding, USD 2.06
• cargo test --locked --features browser-agent: 1070 library + 35 CLI + 5 desktop + 1 MCP binary + 3 MCP stdio passed, 0 failed
• focused process-shutdown and CLI signal tests passed
• repository Biome and Gitleaks pre-push gates passed

Stack

Layer 36 of 38. Base: #238. Draft only. No merge, release, deployment, signing, notarization, or Tauri retirement is authorized before the owner approval gate.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.