fix(exec): ignore OS workqueue threads in pre-fork thread check

[kipz]

Linked Issue

Closes #1423

Summary

On macOS the Supervised pre-fork thread-count check counted OS-managed libdispatch/GCD workqueue threads that Security.framework spawns for SecTrustSettings* XPC during proxy CA setup. Their count scales with load, so under concurrency the total intermittently exceeded MAX_CRYPTO_THREADS (7) and the fork was refused (Cannot fork: process has 8 threads (max 7 with crypto pool)). Those OS threads are parked and fork-safe (covered by libmalloc's pthread_atfork handlers).

An earlier version of this PR counted only nono's own named threads to exclude the unnamed OS workqueue threads. Review caught two problems with that approach: unnamed threads spawned by nono itself (e.g. via bare std::thread::spawn) would silently bypass the check, and the new mach query leaked a port per thread. Rather than fix both by naming every thread in the codebase, this PR now just raises MAX_CRYPTO_THREADS (7 -> 12) to absorb the observed workqueue variance, keeping the original total-thread-count check unchanged.

Agent Disclosure (if applicable)

This PR was generated by an AI coding agent (Claude) on behalf of the contributor. Files consulted: crates/nono-cli/src/exec_strategy.rs (the Supervised fork-safety check and get_thread_count). No code was adapted from third-party sources. Complies with repository requirements: no unwrap/expect, NonoError used for error propagation, DCO sign-off present.

Test Plan

• make ci clean: clippy -D warnings -D clippy::unwrap_used, fmt-check, full suite passing.
• Reproduced on macOS 26.5.2 with a proxy/trust-interception profile at 32-way concurrency: ~4/300 before -> 0/300 after (release build of this branch).

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

Agent Compliance Check (Required for AI/Automated PRs)

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths
• This PR matches the approved or disclosed issue scope

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+7
Lines removed	-4
Total changed	11
Classification	Small (< 50 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

2 issues found: 1 high-severity Mach port resource leak on macOS, and 1 medium-severity fork safety bypass.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[SequeI]

LGTM, this makes sense to me, no big loss in raising the thread limit slightly. Thanks!