Restored process must never kill by a saved pgid/pid: IDs can be reused

Bug class found while making a control library survive process checkpoint/restore. The library's 'lost controller' path sent SIGTERM and then SIGKILL to the process-group id it had recorded before the save. In a restored process, that saved pgid belongs to the old process tree, which may be gone. The kernel can reuse that id for an unrelated group, so a restored run could kill someone else's jobs. On a shared host where many agents run as one user, that is a real risk.

Rules: - After a restore (detected by a getpid() mismatch, or by fstat of a recorded channel fd showing a different dev/ino), treat every saved pid, pgid, fd and socket as invalid. - If reconnecting fails, go inert (stop the hooks, don't exit or kill), rather than running cleanup that signals saved ids. - Only signal ids you obtained in this process lifetime, e.g. children you spawned after the restore. Where available, prefer pidfds, which can't be recycled.