fix(test): eliminate capture-drain and startup-shim termination races #685

Summary

Two process races already present on main block isolated commit validation of #596.

• scripts/verify-backends::_run_captured launches tail -f, sleeps 0.2 seconds after the producer exits, then terminates the reader. This does not guarantee the final output was streamed, even though LAST_OUT captured it. test/bats/145-verify-capture.bats reproduces the missing verbose line on unmodified main.
• scripts/probe-msb-startup::shim creates its child before installing its SIGTERM handler. An early SIGTERM can terminate the shim before forwarding and reaping. A synthetic spawn-delay probe reproduced parent exit -15 and a surviving synthetic child on both main and the candidate; probe cleanup terminated that child.

Scope and acceptance

• Replace timing-only verbose drain with deterministic completion that retains foreground stdin and avoids waiting on daemon-held output pipes.
• Install termination handling before child creation and handle signals received while spawn is in progress; preserve exit status and reap the owned child.
• Add deterministic regressions for delayed output-reader startup and termination during spawn. Preserve normal output, error, stdin, and signal behavior.
• Run focused tests and the full required commit hooks in an isolated environment. No skipped hooks or weakened assertions.

Baseline inspected: f75c87b73bc10151f5ddf5a444358ae134628a04. Current kit-fetch repair remains uncommitted and tracked separately in #596. Operator approved expanding that repair to include these gate fixes.

AI-assisted diagnosis and issue preparation (OpenCode). No live backend or credential operations were used.