Watchdog exits only via exit latch or deadline kill — never a racy isRunning read

[kiki830621]

Refs #91

Summary

The 1-hour CI hang signature (test ran the hung stub's full 3600 s, thrown error lacked 'timeout') proves the kill branch never executed: Process.isRunning spuriously reported false right after run() on the starved runner, the while isRunning watchdog exited with zero iterations, and the code fell through to an unbounded real-thread waitUntilExit().

Fix: a thread-safe ExitLatch flipped by terminationHandler (installed before run()) now gates the loop — it can exit only when the adapter is really gone or via the SIGTERM→SIGKILL deadline branch, so waitUntilExit() is bounded on both paths. The hung-adapter test stub drops from sleep 3600 to sleep 15, bounding any future watchdog regression at seconds of CI instead of an hour.

Verification

• Opus adversarial verify: SHIP, zero blocking — the RCA was upgraded to a discriminating proof (the starvation hypothesis would have produced a 'timeout' message; only the isRunning skip matches the CI log). Report: bug: ExternalEngineTests hung-adapter watchdog flakes on CI — 1-hour hang then wrong error message #91 (comment) (diagnosis) + verify comment on the issue.
• 335 tests / 72 suites green; ExternalEngineTests repeated ×5 locally (~1.5 s hung case, ~0.06 s fast adapters).

Checklist

• Diagnose ✓ (RCA by elimination, upgraded by verify)
• Implement (1 commit)
• Verify ✓ (verify-gated PASS)

---

🤖 Generated by /idd-all. Do NOT add a GitHub close trailer — manual /idd-close after merge.