## Why
On macOS, process-group signals can be denied even when individual members can be signalled. Core execution cleanup used helpers that did not retry those signals against group members.
## What changed
- Make `terminate_process_group` and `kill_process_group` use the existing member fallback on macOS, and simplify MCP and pipe callers to use the shared helpers.
- Use the saved process-group ID when escalating cancellation after the termination grace period, so this path also uses the fallback.
- Update the unsafe process-group ID test to exercise `terminate_process_group`.
GitOrigin-RevId: 1bab28d3d53cd401b51ffe71d41fbece12aed66d
## Why
Signaling an MCP server's process group can fail with `EPERM` on macOS,
preventing owned descendants from being terminated.
## What changed
- When a group signal is denied, enumerate the group's processes and signal
members that still belong to the expected process group.
- Apply the fallback to both `SIGTERM` and `SIGKILL` during MCP stdio server
cleanup, while retaining the existing group signaling behavior elsewhere.
- Reject invalid process group IDs and avoid signaling processes that have
moved to another group.
## Testing
Added macOS tests covering cleanup with a live or exited group leader,
`SIGTERM`-resistant descendants, escalation to `SIGKILL`, and unsafe group IDs.
GitOrigin-RevId: db722475b94dece74244ce8109b3e92f6cfb202a
jif