Process-group runner backed by forcola.

Evidenced one-shot execution requires Forcola 0.7's reviewed PR #97 run/2 contract and matching shim. Forcola 0.6 cannot establish these facts and is rejected before invoking run_evidenced/5. Legacy run/stream callbacks remain available. New options pass through without global environment or application changes. Native exit, cancellation reason, transport, cleanup confirmation/scope and guard close are retained independently. Missing evidence remains unknown. A confirmed process group never proves containment of escaped descendants.

Every codex invocation runs under forcola's Rust shim, which places the CLI in its own process group and kills the whole group (SIGTERM, then SIGKILL) on timeout or when the BEAM dies. That reaps codex and every stdio MCP server it spawned together. The default CodexWrapper.Runner.Port signals only the codex process (SIGINT, SIGTERM, SIGKILL), so anything codex does not stop itself can outlive it (see #48 and closed #33).

forcola closes the child's stdin immediately after spawn (forcola 0.3.4, forcola#67), so codex sees EOF naturally -- the /bin/sh ... < /dev/null wrapper the default runner needs is unnecessary here. Before 0.3.4 forcola left the child's stdin open, and codex exec would print "Reading additional input from stdin..." and hang until the timeout elapsed. The ~> 0.7.0 dependency floor includes this fix, raw output observation and bounded one-shot termination evidence.

forcola requires a finite whole-run bound. Synchronous commands with no :timeout use forcola_default_timeout_ms (five minutes by default); streams use forcola_default_stream_timeout_ms (one hour by default), so a long active turn is not cut off after five minutes.

stream_lines/4 is backed by Forcola.Stream.lines/2, so the NDJSON paths (Exec.stream/2 and friends) get the same group kill on halt, timeout, or BEAM death. Unlike Forcola.Stream.lines/2, it does not raise on a non-zero exit -- it ends the stream, which is what CodexWrapper.Runner.Port has always done and what the CodexWrapper.Runner contract specifies.

This module compiles only when forcola is a dependency. Select it with config :codex_wrapper, runner: CodexWrapper.Runner.Forcola (or the :forcola shorthand). forcola is POSIX-only.