Follow-ups from #910: re-check the agent before removing a worktree on normal exit, test gaps #930

Follow-ups from the review of #910 (non-blocking), tracked here as one issue.

Launcher behaviour

1. On the normal-exit path (agent.ts, the caller's finally that calls onStop), re-check the released agent by its captured identity before removing a worktree this launch created, the same way the signal path does, and keep the worktree when the agent may still be running.
2. Decide what a supervisor should do with exit 0 after the launcher kept a worktree (signal-path survivor and unconfirmed-removal exits now follow supervision).

Tests
3. The zombie branch of the process-identity check (launch-attestation.ts ~704-713, /proc/<pid>/stat state Z) has no test; a Linux test that leaves an unreaped child would pin it.
4. The shipped agent.ts unconfirmed-removal glue is tested only through the STOP_DRIVER replica; add a case through the real command path.
5. FAKE_NONO_DELAY_MS is passed to sleep, which takes seconds; rename it or convert it.
6. The STOP_PEER comment is incomplete.

Refs #668, #672, #686, #910.