fix(herdr): detach Linux remote doctor server start

[V4f1k]

Summary

• detach the Linux Herdr server start from command-substitution descriptors so fm-remote-doctor --fix can return after readiness
• preserve the existing named-session and bounded 10-second readiness contract
• terminate and reap only the direct start child when readiness fails
• add an executable Linux regression for both ready and never-ready foreground server behavior
• wait boundedly for the watchdog child to complete its setsid PGID transition before claiming process-group ownership

Root cause

On Linux, herdr server --session fm-remote remains in the foreground. The previous nested background subshell inherited the command-substitution result pipe used by the doctor. Even after the shell running the start expression returned, the foreground Herdr process kept that pipe open, so command substitution and therefore fm-remote-doctor --fix did not return.

The start child now closes inherited descriptors above standard input, output, and error before exec, while all three standard streams are redirected explicitly. Readiness still comes from the real status probe rather than a sleep.

The first fork CI run exposed a separate race in the new test harness: $! can become visible before the child completes exec setsid, so one immediate ps snapshot can still report the inherited PGID. A Linux ARM64 characterization observed this twice in 500 starts. The watchdog now polls the actual PGID transition within a one-second bound before using the group for lifecycle assertions or cleanup.

Validation

• Linux ARM64 container: three consecutive full tests/fm-remote-doctor.test.sh runs passed after the PGID synchronization fix, including ready return and never-ready cleanup cases
• macOS Bash 3.2: tests/fm-remote-doctor.test.sh passed
• tests/fm-backend-herdr.test.sh passed
• bin/fm-lint.sh passed with ShellCheck 0.11.0
• bin/fm-doc-audience-check.sh passed
• git diff --check origin/main..HEAD passed

The regression fails on the original implementation because the ready foreground server retains the result pipe. It also verifies that a never-ready direct child is bounded and reaped. No live default Herdr session or Oracle host was touched.

Pipeline

Updates from git push no-mistakes

Pipeline run 01M00PYZXYACX45CFVA0G279M3 validated and pushed exact head 934889bcf74123dce271daf0391f8a1693150832:

• intent passed
• rebase passed
• review passed with no findings
• test step skipped by the explicitly requested no-mistakes axi run --skip test; the independent validation evidence is listed above
• document passed
• lint passed
• push passed

The run's PR target selected the upstream contribution route rather than the explicitly authorized fork-only route. That upstream PR was closed immediately without merge. This existing fork PR remains the authorized delivery surface and its own required CI is the acceptance gate.