feat(harness): P1 lock-lifetime hardening — PDEATHSIG + SIGTERM/SIGALRM teardown funnel + 60-min hard deadline

- new harness/lifetime.py: install_lifetime_guards() arms PR_SET_PDEATHSIG(SIGTERM) (with
  post-prctl ppid==1 orphan refusal), a SIGTERM handler raising SystemExit through the run's
  finally: teardown funnel (exit 143), and signal.alarm(3600) funnelling SIGALRM the same way
  with a distinct deadline log line (exit 142). Re-entrant signals during teardown are logged
  and ignored (begin_teardown guard) so a second signal can't abort the running cleanup.
- run_recipe_ci.main(): guards installed first thing, before any abra call/lock; both teardown
  finally: blocks (cold + quick) mark begin_teardown().
- .drone.yml recipe-ci step: harness runs under setsid in its own process group; a trap forwards
  the step shell's TERM/EXIT to the whole group so drone cancel reaches the harness instead of
  leaking it (docs/concurrency.md §8.1).
- PEP 446 note on the recipe-lock open(): the fd is non-inheritable, children never carry it.

runner/harness/lifecycle.py

@@ -48,6 +48,7 @@ def acquire_recipe_lock(recipe: str):
     recipe is in flight. Returns the open lock file — the CALLER must keep a reference for the
     whole run; the lock is released only when the process exits and the fd closes."""
     path = os.path.join(RECIPE_LOCK_DIR, f"cc-ci-recipe-{recipe}.lock")
+    # PEP 446: the fd is non-inheritable, so subprocess children never carry the lock.
     f = open(path, "w")  # noqa: SIM115 — deliberately held for the lifetime of the run
     try:
         fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)