PTY authorization, allocation, and stream safety

PTY authorization resources must use the same canonical boundary-preserving argv serialization as execution; joining arguments with spaces can collapse distinct commands. Bound input writes, queued bytes, retained output, worker output, and line scanning during collection—not after splitting—because grep prefixes and ignored backpressure can amplify memory. Attach child and stream error listeners before checking process state, handle stdin.write callbacks, backpressure, closed-stream races, and EPIPE, and apply identical protections to regex-worker stdin.