linux system adapter: InstallShutdownHook for SIGTERM/SIGINT

[turinglambdaai]

First Linux adapter slice of #120.

The embedded Racket CS runtime installs its own signal handlers, so a staged Linux host can absorb SIGTERM: state flushing on container stops, session shutdown, and kill <pid> is then bypassed.

rivet::system::InstallShutdownHook(callback) gives hosts one safe opt-in shutdown boundary:

• the signal handler performs only a non-blocking one-byte self-pipe write and preserves errno;
• the read end remains blocking, so the detached watcher cannot mistake EAGAIN for shutdown;
• the watcher restores default SIGTERM/SIGINT handling before running the callback on a normal stack, then uses _Exit to avoid static-destruction races;
• a second signal exits immediately if a callback hangs;
• pipe2(O_CLOEXEC) and checked fcntl setup prevent descriptor inheritance and signal-handler deadlock;
• partial installation failures restore prior signal dispositions and close both descriptors;
• installing twice throws, matching InstallCrashHook.

The Linux embedded-roundtrip workflow now launches a real probe process, proves it stays alive before SIGTERM, verifies the callback marker, and requires a clean zero-status exit within five seconds.

Hosts still opt in by calling the hook early on the main thread. Scaffold wiring and the macOS/Windows equivalents remain follow-up work, so #120 stays open.