Harden credential cleanup fixture and qualify CLI RC3 publication

[irl-dan]

Linux source admission can exhaust the credential fixture's 300 ms bound before its escaped-child PID is recorded. The test then reads an empty PID and probes /proc/stat, reporting global CPU statistics as a surviving descendant. Publish the complete PID atomically before unrelated argv/environment logging, read the newline-free mode with shell builtins, and require a nonzero numeric PID before probing procfs.

Preserve the 300 ms call bound, three-second completion bound, credential-unavailable result, and killed-or-zombie assertion. Missing PID remains an explicit fixture failure. Only the Linux #[cfg(test)] module changes; production regions are byte-identical. Local shell controls cover normal setup and an injected slow unrelated prelude; Linux Rust CI remains authoritative. Independent read-only diagnosis/repair review agrees.

This supersedes release-plan PR47 and carries its unchanged qualified CLI 0.15.0-rc.3 plan. Frozen source 1941a34, native archives and two accepted live attempts remain unchanged; all four exact native/Homebrew gates and original final-main qualification passed. Fresh USD 20 reservation is closed, actual billing unknown, no paid retry. The original PR47 source failure remains retained. No production cleanup fix, Apple signing, stable/latest, default alias or kernel promotion claim. Merge/publication require all substantive exact-head checks passing.