feat(process): replace procfs sampling with event-backed process-tree capture

[morluto]

Summary

Replace 50 ms procfs sampling with event-backed capture of root/child/grandchild spawn, exit, re-exec, and reparent events.

Closes #332.

Changes

• Event types: spawn, exit, re_exec, reparent, signal, name_change, thread_create, thread_exit
• Process reconstruction: Full tree rebuilding from events with children, timestamps, and lineage tracking
• Short-lived detection: Descendants with spawn-to-exit < 100ms are counted
• Re-exec tracking: Detects and records re-exec with updated executable and arguments
• Reparenting: Records previous PPID and current PPID for reparented processes
• Utility functions: getDescendants (BFS traversal), containsProcess, maxTreeDepth
• Cross-platform: Event schema supports platforms where supported; unsupported platforms report typed unavailability

Verification

npm run typecheck   # passes
npm run knip        # passes
npx vitest run tests/eventProcessTree.test.ts  # 10 tests pass

Acceptance criteria

• ✅ Short-lived descendants are not missed
• ✅ Re-exec and reparenting are recorded with correct lineage
• ✅ Integration is cross-platform where supported; unsupported platforms report typed unavailability

Continue this on Linzumi

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.