...with static `libc++` and macOS min version

…in handlePush

ByteQueue::handlePush() in queue.c++ called bufferData(0) when a partially
consumed entry could not satisfy the next pending BYOB readAtLeast() request.
This re-buffered the entire entry from offset 0 instead of from the current
entryOffset, duplicating already-consumed bytes and inflating queueTotalSize.
On the next enqueue, the KJ_REQUIRE at line 1110 (state.queueTotalSize <
pending.pullInto.atLeast) would fail because the duplicated bytes made
queueTotalSize exceed atLeast. The fix changes bufferData(0) to
bufferData(entryOffset) so only the unconsumed tail is buffered.

The regression test creates two concurrent readAtLeast(5) BYOB reads with
5-byte views, enqueues 7 bytes (partially consumed by read cloudflare#1, leaving 2
bytes for read cloudflare#2's buffer), then enqueues 4 more bytes. Pre-patch this
triggers the assertion failure; post-patch both reads complete correctly.

Test validation: VALIDATED LOCALLY
Pre-patch run: FAIL (bazel test //src/workerd/api/tests:streams-byob-concurrent-readatleast-test@)
Post-patch run: PASS (bazel test //src/workerd/api/tests:streams-byob-concurrent-readatleast-test@)

Refs: AUTOVULN-CLOUDFLARE-WORKERD-18

…fork gap cloudflare#2)

Native spawn had no pid, no ppid, no lifecycle events, and exited children
vanished. Add OS-faithful observability:

- pid: a process-global monotonic counter in C++ (ChildProcessUtil.nextPid);
  pid 1 is the root DO (workerd's default process.pid), so children start at 2.
  The probe injects the child's pid onto its process.pid so the child stamps it
  as its own children's ppid -- ppid chains reconstruct the full pstree.
  child.pid (Node-faithful) + child.ppid (fork-only) exposed on the handle.
- lifecycle event stream: spawn (pid, ppid, argv) and exit (pid, code) events
  are appended to a process-global, append-only log as they happen. A consumer
  reads it incrementally via readProcessEvents(cursor) -- an EVENT STREAM, not a
  live snapshot: exited processes stay observable, so a live pstree AND an
  exited-history view are reconstructible. Emitting is a synchronous, non-blocking
  append -- it never keeps a process alive or blocks drainProcess quiescence.

The spawn scratch dir is now keyed by the globally-unique pid (was a per-isolate
counter + Date.now), so concurrent spawns across isolates sharing /tmp can't
collide.

Adds child_process-spawn-observability-test: numeric child.pid; nested spawn's
grandchild.ppid == parent.pid; and a grandchild that exited before the read is
still observable (spawn + exit events present).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>