fix: inspect macOS processes when ps is blocked

[janicduplessis]

Description

stim stop cannot verify its own log collector when a macOS sandbox refuses to execute ps. It correctly leaves the process alone, but cleanup remains incomplete.

Fixes #477.

Solution

Fall back to read-only macOS process APIs when ps execution fails. The helper checks same-user identity before and after reading bounded arguments, includes zombie state, and preserves argument boundaries. Other platforms and successful ps calls are unchanged.

The helper is compiled on first use with Apple command-line tools and cached under STIM_HOME by source hash and architecture. Compilation or inspection failure remains unverified, never permission to signal a process. This adds a bounded cold-start compilation cost only on the fallback path.

Test plan

Run node --test test/e2e/macos-process.e2e.js on macOS. The real sandbox test covers collector ownership, workspace paths with spaces, exited/zombie processes, protected-file denial, and denied native inspection. The native harness also checks identity changes and argument/environment boundaries.

[janicduplessis]

Superseded approach: the user requested persisted unique-pid identities and leaving externally started Metro processes alone. unique-pid PR appandflow/unique-pid#1 is merged with all platform and packaging CI passing; publication is pending. Replacement Stim implementation is in the isolated fix/persisted-process-477 worktree, not yet committed: host ps execution is removed and the real-child collector ownership regression passes, but broader test updates and validation remain. Do not merge this compile-on-first-use helper implementation.

[janicduplessis]

Superseded by #487, which uses the published unique-pid library and persisted Stim ownership records. The replacement intentionally leaves externally started processes alone and removes the compile-at-first-use inspection approach from this proposal.