Follow-ups from #909: promote-latest signal-death exits, lock ownership on release, fixture gaps #925

Follow-ups from the review of #909 (non-blocking), tracked here as one issue.

promote-latest.sh behaviour

1. Only exit 124 maps to UNCERTAIN on a mutating npm call (~550, ~702). The supervisor reports a signal death as 128+n (npm-supervisor.mjs ~77), so an add whose supervisor is killed takes the ordinary rollback path and reports "rolled back", and an npm child that outlives a killed supervisor can still land the promote. Treat 129-159 like 124 on mutating calls and on the rollback add (or give signal death its own supervisor exit code), with a fixture that SIGKILLs the supervisor during a held add.
2. release_lock (~166-172) removes the lock on the in-memory lock_owned flag alone. Read $lock_dir/pid and remove only when it equals $$, so a run never deletes a lock another run re-created.
3. A signal between the lock mkdir and lock_owned=1 (~181-182) leaves a lock the next run refuses as "PID unknown" (fails closed; the header states it). Close the window.
4. reconciliation_report should list the packages already moved when a signal lands during a promote write.
5. Process-group INT/HUP is still forwarded to npm during a rollback write, against the "signals ignored" wording; check whether Node resets an inherited SIG_IGN.
6. An unwritable lock root reports "lock held (PID unknown)"; a supervisor killed mid-write takes exit 4.

test-promote-latest.sh
7. Fixture P's "no UNCERTAIN", "lock released" and "registry restored" checks pass even when the run never reaches the rollback; make them conditional on the exit-4 assertion.
8. The AL window uses a wall clock, so a clock step could flake it; consider a lower-bound slack note.
9. No fixture covers the rollback path through on_signal that ends in an uncertain timeout; "a second run refuses printing the reason" is tested only for the committed case (AD), not AE.
10. Text: the registry helper comment omits the delayed-put mode (and otp challenges each package's first PUT); test.yml says "The real-npm case" in the singular; M10b's fail message says "fixture AL is blind" though AL never runs with a slow spawn; the header word "together", exit 4's "interrupted (rolled back…)" and "the pre-add attempt flag" are stale; the usage Environment: list omits NPM_TIMEOUT_SECONDS; the mutant-cycle skip lines read "npm/node/python3 not installed" where the fixture lines read "npm, node or python3 not installed".

Refs #372, #373, #374, #909.