[todie]

Summary

• Drain Signal Forwarding: Upon transitioning to EnterDrain, TeardownCoordinator forwards the parsed catchable graceful signal (defaulting to SIGTERM) to all tracked process groups via kill_process_group and individual child processes.
• PidFd Termination Polling: Added PidFd::wait_timeout(&self, timeout: Option<Duration>) -> io::Result<bool> using Linux poll(2) on the process descriptor (POLLIN / POLLHUP / POLLERR), providing race-free event-driven exit detection.
• Child Supervision in kd init: Extended the container init subcommand to optionally accept and supervise an application process and its arguments under an isolated process group.
• Exit Status Propagation: Fixed TeardownCoordinator::step to detect normal child completion and immediately force-terminate the state machine with the child's exit code, preventing hangs when a child exits cleanly without external signals.
• Dependency Pin Alignment: Updated specs/0004 to match sha2 0.11.0 in Cargo.lock.

Verification Evidence

• cargo test --workspace -j 2: All 55 tests pass cleanly.
• make check: fmt-check, clippy (-D warnings), test, doc-test, and deny passed.
• make hygiene: Passed (typos, sort-check, machete, spec-check, toolchain-check, pin-check).
• make smoke: Passed with zero-I/O domain verification.
• Verified 100% 7-bit ASCII purity on all modified files.
• Manual verification: kd run -- echo hello exits 0, and kd init -- /bin/sh -c 'exit 42' exits 42.

Co-authored-by: Brokkr forge@forge.unsigned.gg
Reviewed-by: Mimir mimir@unsigned.gg