test(resident-service): kill the supervisor before what it supervises, and make a leak name itself

The teardown reaped resident services while their supervisor was still up. The
ServiceSet is hosted in the DAEMON — deliberately, so a routine brain restart
does not bounce every resident service through the orphan path — and
servicehost's Relaunch arm re-mints a service pid when one dies un-asked. So
killing a supervised service under a live supervisor did not reduce the
population, it ROTATED it: the service came back as a new pid that no per-pid
check in this test holds, which is the shape of the leak this rig keeps
catching. The daemon's own comment already promises that a killed daemon's
services are reaped by the next daemon's boot sweep; the per-pid authenticated
kill here is that sweep done by the rig, not a new mechanism.

Five changes, all test-side:

- The supervisor host dies FIRST. broker.kill()+wait() moves above the
  per-service authenticated_kill loop; services next; brain last. The Child
  handle stays the mechanism — authenticated by construction, never a
  breadcrumb.
- `daemon stop --force` is OBSERVED. It was `let _ =`, so the one command whose
  failure would explain a leak left no trace. Both teardown exit codes plus the
  stop's stdout and stderr are printed unconditionally: a stop that SUCCEEDED
  and leaked anyway is the more interesting of the two findings.
- Survivors carry their own identity. Population.survivors widens from
  (pid, PathBuf) to a Survivor record with started_at, parent, parent_exe and
  `via` (which selector claimed it). A bare pid+image names the two parts that
  go stale fastest — by the time the panic is read the number may belong to
  someone else, and the image is the same spt binary every process in the suite
  runs. The parent is the discriminator: parent = this run's daemon is a
  teardown-ORDER defect, parent gone is an orphan, and those want different
  fixes. The pid->ppid map is read ONCE per sweep; stamping each survivor from
  its own fresh read would print a parent set that never existed at any single
  instant.
- The stderr sinks are preserved BEFORE any assertion can abort. SPT_HOME is a
  TempDir: a failing assertion unwinds, the drop deletes the directory, and the
  brain/daemon stderr that explains the leak goes with it. The sinks are copied
  to <target>/test-artifacts/resident_service_e2e/<unix-ms>/ (SPT_TEST_ARTIFACTS
  overrides; the target root is derived from the test binary's own path, so it
  follows CARGO_TARGET_DIR however it was spelled), and the leak assertion cites
  the directory, reports what was copied or why it was not, and pastes a bounded
  200-line tail with an elision count — because on CI the job log is the only
  artifact that survives and a path on the runner is not evidence anyone can
  open.
- The previously unidentified leaked child is identified BY CONSTRUCTION rather
  than hunted: that pid is long dead and cannot be named now, but the next
  occurrence prints its parent and start time in the failure text itself.

FLAKE-LEDGER row for this rig stays OPEN until a Windows golden passes through
the changed teardown.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WAw9XAcTR8oSwzYPsqZoY2

Co-authored by: hertz