fix(scripts): await the pack:verify web child's exit before removing its work dir (#1895)

* fix(scripts): await the pack:verify web child's exit before removing its work dir

`pack-and-verify.mjs` had the same kill-then-remove shape that made
`smoke:tui` flake with ENOTEMPTY in #1801: `verifyWeb()`'s
`finally { stop() }` only *delivered* SIGTERM, then the main flow
`rmSync`'d the work dir immediately, and `fail()` did the same back to
back.

Applies the #1814 treatment, factored into a shared
`scripts/lib/child-cleanup.mjs` so the two scripts can't drift:

- `stopChild()` — SIGTERM, await the child's `exit`/`close`, escalate to
  SIGKILL after a grace period, and ultimately proceed with a warning so
  a wedged child can never hang the script. `verifyWeb()`'s `stop()` now
  goes through it and is awaited, so the child is gone before the caller
  removes `work`.
- `removeSafe()` — `rmSync` that warns instead of throwing. Used on both
  success-path removals (a leftover temp dir must never fail a run that
  passed) and in `fail()`, where an ENOTEMPTY could otherwise bury the
  real diagnostic under an rmSync stack and skip the "tarball retained
  at ..." hint. `fail()` stays synchronous — it is called from sync
  contexts and ends in `process.exit()` — so it best-effort signals the
  child; `removeSafe()` is what makes that safe.

`smoke-tui.mjs` adopts `removeSafe()` for its `cleanup()`. Its `done()`
keeps its bespoke wait (documented inline): that one must keep waiting
for `close` *after* `exit` on a shorter re-armed deadline so the quoted
output is complete, which `stopChild()`'s first-of-exit/close contract
deliberately does not do.

Adds `scripts/lib/child-cleanup.test.mjs` (10 cases, `node --test` via
`npm run test:scripts`) covering the SIGTERM/SIGKILL escalation, the
`close`-only spawn-failure path, the never-hang give-up, late events
after giving up, and that `removeSafe` warns rather than throws.

`npm run ci` passes, and `npm run pack:verify` (not in the gate — needs
network) was run end to end and passes with no cleanup warnings.

Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(scripts): normalize stopChild's graceMs and correct removeSafe's JSDoc

Copilot review round 1 on #1895.

- `stopChild()` trusted `graceMs` as given, but call sites build it as
  `Number(process.env.X ?? 5000)` — a typo yields `NaN`, which
  `setTimeout` treats as `0`. That would fire SIGTERM and SIGKILL in the
  same tick and print "did not exit within NaNms", collapsing the whole
  escalation silently. New exported `normalizeGraceMs()` falls back to
  `DEFAULT_EXIT_GRACE_MS` for anything non-finite or non-positive, with
  two tests: the table of bad values, and an end-to-end one asserting a
  `NaN` grace period still leaves only SIGTERM sent a turn later.
- `removeSafe()`'s `@returns` said "true if the path was removed", which
  is inaccurate for a missing path (`force: true` makes it a no-op
  success). Reworded to say what it actually reports.

`npm run ci` passes.

Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/smoke-tui.mjs

@@ -20,9 +20,10 @@
  */
 
 import { spawn, spawnSync } from "node:child_process";
-import { mkdtempSync, rmSync, existsSync, writeFileSync } from "node:fs";
+import { mkdtempSync, existsSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { removeSafe } from "./lib/child-cleanup.mjs";
 
 const repoRoot = resolve(import.meta.dirname, "..");
 const launcher = join(repoRoot, "clients", "launcher", "build", "index.js");
@@ -126,18 +127,12 @@ const EXIT_GRACE_MS = Number(process.env.SMOKE_TUI_EXIT_GRACE_MS ?? 5000);
 const DRAIN_MS = 500;
 
 function cleanup() {
-  try {
-    rmSync(work, { recursive: true, force: true });
-  } catch (err) {
-    // Never turn a passing smoke into a failure over a leftover temp dir; the
-    // OS reclaims tmpdir anyway. On the normal path this should not fire, since
-    // removal waits for the child's `close` (see done()) — but the two give-up
-    // branches there call finish() without it, and a process may still hold the
-    // dir, so this is expected rather than anomalous on those.
-    console.warn(
-      `smoke:tui — could not remove temp dir ${work}: ${err.message}`,
-    );
-  }
+  // Never turn a passing smoke into a failure over a leftover temp dir; the OS
+  // reclaims tmpdir anyway. On the normal path a warning should not fire, since
+  // removal waits for the child's `close` (see done()) — but the two give-up
+  // branches there call finish() without it, and a process may still hold the
+  // dir, so it is expected rather than anomalous on those.
+  removeSafe(work, { label: "smoke:tui" });
 }
 
 // Tail of the child's output, for quoting in a diagnostic. Slicing an Ink
@@ -184,6 +179,12 @@ function done(code, message) {
   // never `exit`, so an `exit` wait would hang here until the give-up timer and
   // then blame a SIGTERM the child never received. `close` also guarantees the
   // stdio pipes are drained, which is what makes the thunked messages complete.
+  //
+  // This deliberately does NOT use lib/child-cleanup.mjs's `stopChild()` (which
+  // pack-and-verify.mjs uses against the same race): that helper resolves on the
+  // FIRST of exit/close, whereas this wait is entangled with the drain phase —
+  // it must keep waiting for `close` after `exit`, on a shorter re-armed
+  // deadline, so the quoted output is complete. Only `removeSafe()` is shared.
   const forceKill = setTimeout(() => child.kill("SIGKILL"), EXIT_GRACE_MS);
 
   // Deadline for the wait. Re-armed shorter once the child is gone, since from