Linux local command backend with verified process-group cleanup.

Commands start behind a fixed launcher handshake. The launcher blocks until its process identity has been verified, so a job is returned only after its process group is safe to address. This adapter does not provide an OS sandbox; commands that create a new session are outside its descendant-cleanup scope.

Construction accepts trusted absolute :setsid_path, :sh_path, and :kill_path executables. Defaults resolve PATH once during start_link/1; launch, cleanup and shutdown reuse those fixed paths. Each path must name an executable regular file. Hosts own immutable executable/script snapshots; pinning a path does not prevent its contents from changing. :launcher_script remains available for a trusted private launcher snapshot. Custom :cleanup_reconciler and :shutdown_signaler callbacks retain their contracts.

Cleanup confirms absence through a fresh Linux /proc scan, including descendants whose leader has exited. A matching live leader avoids that scan only when proving presence. ENOENT and ESRCH mean that one proc entry vanished; the remaining group is still scanned. Other probe errors remain uncertain. The default 750 ms cleanup budget is unchanged; timeout errors include the last cleanup phase and elapsed timing for diagnosis.