…ives

Pins the property whose absence got PR boxlite-ai#520's global waitpid(-1) reaper
reverted (Issue boxlite-ai#523, criterion #2): a child the reaper never registered
must be left for its owner to wait(). Two-side verified — injecting a
global waitpid(-1) into the sweep makes the owner's wait() return ECHILD
("No child processes") and the test fail; the scoped sweep preserves
exit code 42.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ives

Pins the property whose absence got PR boxlite-ai#520's global waitpid(-1) reaper
reverted (Issue boxlite-ai#523, criterion #2): a child the reaper never registered
must be left for its owner to wait(). Two-side verified — injecting a
global waitpid(-1) into the sweep makes the owner's wait() return ECHILD
("No child processes") and the test fail; the scoped sweep preserves
exit code 42.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ives

Pins the property whose absence got PR boxlite-ai#520's global waitpid(-1) reaper
reverted (Issue boxlite-ai#523, criterion #2): a child the reaper never registered
must be left for its owner to wait(). Two-side verified — injecting a
global waitpid(-1) into the sweep makes the owner's wait() return ECHILD
("No child processes") and the test fail; the scoped sweep preserves
exit code 42.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…oxlite-ai#523)

Two production code paths spawn shim subprocesses, send them SIGKILL,
and never `waitpid` — so a dead shim sits in `/proc` as `State: Z`
indefinitely, holding the PID slot and (in `boxlite serve` mode)
blocking init from reparenting because the daemon is still its parent.

**#1: async death (OOM / external SIGKILL/SIGTERM / internal panic).**
The shim dies without anyone in the runtime asking it to. The only
loop already polling shim liveness is health check (`box_impl.rs::
spawn_health_check`), but its `shim_died` branch did just one thing:
mark `Stopped` / `Unhealthy` in the DB and break. No `waitpid`. The
`is_process_alive` detector correctly treats `State: Z` as dead, so
the branch *fires* on a zombie — it just doesn't reap.

Fix: in the `shim_died` arm, `libc::waitpid(pid, _, WNOHANG)` in a
short bounded retry loop. SIGKILL → zombie transition is not always
synchronous with the wait queue: WNOHANG can briefly return 0 before
the kernel posts SIGCHLD/wait status, even when `/proc` already shows
`State: Z`. 500 ms ceiling with 10 ms backoff covers the race without
ever stalling the health-check loop.

The fix only takes effect if a health check task is *running*, so:

  - `AdvancedBoxOptions::default()` now spawns a health check with
    `HealthCheckOptions::default()` instead of `None`. Default
    interval 30 s, 60 s start period, 10 s ping timeout — the
    pre-existing defaults; no operator-visible cost beyond one ping
    per box per 30 s.
  - The decision is documented inline on the `health_check` field:
    health check is the *only* always-on shim-state watcher; explicit
    `health_check: None` opts out of both pings and zombie reaping
    (operator takes responsibility).

**#2: `boxlite serve` + REST `rm --force`.** Daemon's `rt_impl::
remove_box(force=true)` calls `kill_process(pid)` (SIGKILL by PID,
bypassing the canonical `stop()` path that *does* reap via
`Child::wait()`). The handler returns immediately and the box is
removed from the DB. The shim's `PPid` stays pointed at the daemon
(still alive), so init can't help.

Fix: after `kill_process`, run the same `WNOHANG`-with-deadline
polling loop already used in `vmm/controller/shim.rs::ShimHandler::
stop`'s SIGTERM path. 2 s deadline matches the existing
`GRACEFUL_SHUTDOWN_TIMEOUT_MS`; if SIGKILL doesn't yield a reapable
state in 2 s, the kernel is wedged and a longer wait won't help.

Three reproducer tests, each two-side verified (revert the relevant
production change → test goes red with the exact zombie signal;
restore → test goes green):

  - `boxlite::tests::health_check::
       health_check_becomes_unhealthy_when_shim_killed`
       (existing test on main, now actually passes — the
       `PerTestBoxHome::drop` zombie-leak panic is the load-bearing
       failure; this PR adds a pin on `/proc/<pid>/status` not being
       `State: Z` so the regression signal is inline)
  - `boxlite::tests::health_check::
       health_check_becomes_unhealthy_when_shim_sigtermed`
       (new — same shape, SIGTERM, covers k8s liveness initial
       signal / cgroup OOM initial / systemctl stop / plain kill)
  - `boxlite_cli::tests::serve_rm_force_zombie::
       boxlite_serve_rm_force_active_box_no_zombie_left_in_proc`
       (new — spawns real `boxlite serve` subprocess, drives REST
       `DELETE /v1/boxes/<id>?force=true` via CLI `--url`, watches
       `/proc/<shim_pid>/status` from *outside* the daemon. The
       failing-path panic captures `PPid:` against the daemon's
       PID — the load-bearing diagnostic that proves init isn't
       going to clean this up because the daemon is still alive
       and still the parent.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>