fix(runtime): pass -- before negative pgid so group kill works on Ubuntu

Ubuntu's procps kill exits 0 on 'kill -TERM -<pgid>' without signaling
anything, so the process-group kill silently no-opped and runtime IO
cleanup waited out the descendant's full sleep. Add the '--' separator
(verified on ubuntu:24.04, Debian trixie, and macOS) and restore the
2s IO shutdown grace now that the kill actually lands.

Also make the core pipefail-rerun test expect None on Windows, where
pipeline_rerun_command intentionally suppresses the bash suggestion.

Author: AdityaVG13

crates/tokenzero-core/src/tests.rs

@@ -516,9 +516,16 @@ fn shell_c_wrappers_detect_masked_inner_pipeline_failures() {
                 .is_some_and(|warning| warning.contains("mask")),
             "{command}: {status:?}"
         );
+        // pipeline_rerun_command suggests a bash rerun, which is suppressed
+        // on Windows where bash is not assumed to exist.
+        let expected_rerun = if cfg!(windows) {
+            None
+        } else {
+            Some("bash -o pipefail -c 'false | true'")
+        };
         assert_eq!(
             status.pipeline_rerun_command.as_deref(),
-            Some("bash -o pipefail -c 'false | true'"),
+            expected_rerun,
             "{command}"
         );
     }

crates/tokenzero-runtime/src/lib.rs

@@ -621,11 +621,10 @@ fn deadline_from(start: Instant, timeout: Duration) -> Instant {
 
 fn process_io_shutdown_grace() -> Duration {
     // After terminating the group, give the IO workers room to observe the pipe
-    // close and drain. A heavily loaded CI runner can take noticeably longer than
-    // a quiet desktop to propagate the kill and unblock the reader, so this stays
-    // generous while remaining well under any realistic background-descendant
-    // sleep so cleanup is still demonstrably prompt.
-    Duration::from_secs(5)
+    // close and drain. Kept well under the 5s descendant sleeps in the runtime
+    // tests so a regression in the group kill fails loudly instead of being
+    // absorbed by the grace window.
+    Duration::from_secs(2)
 }
 
 /// IO wait after the main child has already EXITED: an exited process
@@ -676,16 +675,21 @@ fn terminate_unix_process_group(pgid: u32) {
     if pgid == 0 {
         return;
     }
+    // The "--" separator is load-bearing: Ubuntu's procps kill accepts
+    // `kill -TERM -<pgid>` with exit 0 yet signals nothing, so the group
+    // kill silently no-ops without it (Debian and macOS tolerate both).
     let target = format!("-{pgid}");
     let _ = Command::new("kill")
         .arg("-TERM")
+        .arg("--")
         .arg(&target)
         .stdout(Stdio::null())
         .stderr(Stdio::null())
         .status();
     thread::sleep(Duration::from_millis(50));
     let _ = Command::new("kill")
         .arg("-KILL")
+        .arg("--")
         .arg(target)
         .stdout(Stdio::null())
         .stderr(Stdio::null())