session-open-runtime.test.ts leaks an Apple runner pkill into the next test

[thymikee]

Symptom

In src/daemon/session-lifecycle/internal/__tests__/session-open-runtime.test.ts, the test open --metro-port alone stays host-ambiguous on a physical Android device fails intermittently with the hermetic-signal guard:

Error: This test tried to signal 2 process(es) this vitest worker did not spawn.
spawn pkill -TERM -f xcodebuild.*test-without-building.*AgentDeviceRunner\.env\.session-sim-1-[0-9]
spawn pkill -KILL -f xcodebuild.*test-without-building.*AgentDeviceRunner\.env\.session-sim-1-[0-9]
    at packages/host-kit/src/internal/exec.ts:140 (runSpawnedCommand)

The pattern names device sim-1, i.e. the Apple simulator session opened by the previous test in the same file (open --metro-port alone defaults the host to 127.0.0.1 on an iOS simulator). That test's open reaches the real runner disposal (packages/platform-apple/src/runner/runner-disposal.ts killRunnerXcodebuildProcesses via runner-session.ts) and its two pkill spawns are not awaited by the test, so they land in whichever test runs next.

Repro (on main @ 96727a0)

pnpm vitest run --project unit-core \
  src/daemon/session-lifecycle/internal/__tests__/session-open-runtime.test.ts \
  src/daemon/__tests__/wait-runtime.test.ts \
  src/daemon/handlers/__tests__/snapshot-alert.test.ts --maxWorkers=1

Failed 1 of 3 runs on main, 2 of 3 on a branch with unrelated daemon changes (#2296), and twice inside pnpm check:affected --run's vitest related set for that branch. The file passes alone; the leak needs enough load for the disposal to spill past the test boundary.

Fix direction

Mock the runner-session seam the iOS open reaches (the test already mocks @agent-device/platform-apple/runner/operations, but disposal goes through runner-session.ts / platform-runtime-apple-application-tools.ts stopRunnerSession), or make the iOS test await the disposal it triggers. Per the guard's own message: mock the seam, do not let a unit test spawn pkill.