Don't kill a pid named in a socket message without SO_PEERCRED

A supervisor that 'adopts' an already-running worker took the pid from the worker's ready message on a Unix socket, then killed that process group at shutdown. A fake ready naming an unrelated process got that process's group killed. Fix: read the real peer pid with getsockopt(SO_PEERCRED) on the connected socket. Accept the message only if its pid matches, and refuse to adopt if the peer pid can't be read. Before signalling later, re-check that the pid is not a zombie and that its /proc/<pid>/stat start time hasn't changed, which guards against pid reuse. Red test: send a fake ready naming a detached sleep, and assert that the adopt is refused and the sleep is still alive afterwards.