🤖 tests: follow-ups for the bug-bash sandbox runner library (#5875) #5877

Follow-ups from the final readiness check of #5875 (merged in abfa4e32d5), the runner library of the bug-bash sandbox (#5714, B1 PR 2). None of them blocked that merge, because the library has no entry point yet. Items 1 and 2 must be fixed in B1 PR 3, before PR 3 adds the launch command.

1. Process group. Session.#stop and the per-command timeout signal only the direct child (tests/bugbash/sandbox/runner.ts, #stop and #spawn). Grandchildren, such as the git and grep that build.sh --key starts, can outlive a stop and keep stdout open. Fix: spawn each child as a group leader and signal the group.
2. cleanup(job) keeps the first call's job. cleanup() stores the promise of its first call, so an early cleanup() without a job makes a later cleanup(job) skip the container removal. Fix: register the job before the container starts, or assert that every call passes the same job.
3. "removed" with no client. When a job is given but preflight never connected, cleanup returns "removed" without checking Docker. No container can exist then, but a separate state (for example "none") is more accurate.
4. Private config folder leak. mkdtempSync in #connect can run after cleanup has finished, and that folder is then never removed. Fix: check the stop state before creating the folder, or create it inside cleanup's ownership.
5. The name filter is a regex. --filter name=^/<name>$ treats . and other regex characters as patterns. The two label filters still limit the match. PR 3 must validate the container name format.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $115.92