[joepetjr]

Summary

A timed-out call killed only the direct child. Anything the CLI had spawned kept running and held the pipes.

• On POSIX each call now runs in its own session. A timeout, an interrupted wait, or an interrupted fan_out sends SIGTERM to the whole process group, waits AGENT_TERM_GRACE_S (default 5 seconds), then sends SIGKILL to what is left.
• The timeout AgentError keeps the partial output on .stdout and .stderr, and quotes a tail in the message.
• A normal exit is unchanged.
• README and CHANGELOG state the limits.

Plan unit: CBR-2 (portfolio remediation 2026-09-29).

Limits, stated in the docs

• Windows has no POSIX groups. Only the direct child is killed there.
• A descendant that starts its own session or group escapes.
• A killed call has no cost record, because the CLI writes that only at exit. None is invented.

Design decisions to review

• The registry of live children is module-wide. An interrupted fan_out stops every tree this module is running, including one from a concurrent fan_out in another thread.
• The test seam moved from subprocess.run to driver._run_bounded. Existing assertions are unchanged. Only the patch target and the fake's signature changed.

Test plan

• New POSIX-only tests use a stand-in script with a grandchild process, never the real CLI: timeout kills the grandchild, direct-call interrupt kills the tree, fan_out interrupt kills every live tree, normal completion unchanged. Three were red before the change ("grandchild survived the timeout").
• Full suite locally: 79 passed. The 20 existing driver tests still pass.

Merge order

This PR and the frame-id PR both add a line under Unreleased in CHANGELOG.md. Whichever merges second needs a one-line conflict fix there.