PTY process-group termination

Trap: TERM-to-KILL on direct PTY process groups looks like complete descendant containment because it handles ordinary children, but setsid() and daemonization can escape. Fix: bound cleanup, wait for tracked groups to disappear, and state that deliberate escape is outside the accepted byk trust model. Never describe this PTY as cgroup-contained or a general sandbox.