fix(menubar): await terminationHandler, not a blocked queue thread (real fix for the Loading wedge)

[iamtoruk]

Summary

Fixes the menubar wedging on "Loading…" with an unresponsive popover after sustained idle/use — the exact symptom #426 targeted but did not actually resolve. A build carrying #426's runProcess still wedged after ~a week of soak; a live sample showed ~80 threads parked in DataClient.runProcess → waitUntilExit with the timeout never firing.

Root cause

#426 moved the blocking waitUntilExit and its timeout watchdog onto the same global(qos:.utility) queue. Under sustained load every utility worker ends up blocked in waitUntilExit, so the timeout (same queue) can never be scheduled to kill the stuck processes — re-creating the original deadlock at the larger global-queue scale (which is why it took ~a week to saturate instead of minutes). A watchdog living on the queue it's meant to rescue can't fire once that queue is saturated.

The CLI itself is healthy (status --format menubar-json --period 30days returns in 16s) — the wedge is entirely in the Swift subprocess-wait layer.

Fix

• Await process.terminationHandler (set before run(), bridged through a one-shot ProcessExitSignal) instead of parking a worker thread in waitUntilExit. terminationHandler fires on a Foundation-managed queue and blocks nothing, so the timeout always has a free thread to fire on.
• Add an actor-based AsyncSemaphore capping concurrent CLI spawns at 6 so a wake-burst of refreshes can't fan out into dozens of node processes.

Testing

• swift build clean. Rebuilt + relaunched the menubar; live sample of the new build shows zero waitUntilExit frames and no CLI pile-up.
• New tests: 50 concurrent normally-exiting processes all complete via the terminationHandler path; the timeout reliably fires + terminates under concurrency; the semaphore caps concurrency at its limit.

Heads-up: pre-existing red CI on main (unrelated to this PR)

swift test currently fails to compile two test files on main — ContributionHeatmapTests and AppStoreRefreshRecoveryTests — missing localModelSavings/savingsUSD args after a payload field was added during the week. This PR doesn't touch those files; it's a separate pre-existing breakage. Can fix in a follow-up.

Supersedes the same-queue approach merged in #426.