Linux local command backend with verified process-group cleanup.

Commands start behind a fixed launcher handshake. The launcher blocks until its process identity has been verified, so a job is returned only after its process group is safe to address. This adapter does not provide an OS sandbox; commands that create a new session are outside its descendant-cleanup scope.