fix(subprocess-local): fence descendant adoption on the shell's start identity

A recycled shell pid could donate an unrelated process's children to the
terminal session's cleanup signalling: post-exit rescans queried
processTree/processSession by numeric pid alone. The handle now captures
the spawned shell's start identity at construction and adopts newly
scanned members only while the root pid still carries it; already-adopted
members keep their own identities, which every signal already rechecks.
Regressions cover a recycled root donating an imposter child and a shell
whose identity was never observable; the terminal fakes now model the
root row the real /proc and ps scans include.

Also from the review round: tool-pty's dependency list is re-sorted, and
the LSP renderer documents the deliberate drive-letter reading of
ambiguous file: URIs (display-only blast radius).

packages/subprocess/subprocess-local/tests/local.spec.ts

@@ -249,7 +249,7 @@ describe('LocalSubprocessService', () => {
       ;(ctx.subprocess as InstanceType<typeof IsolatedLocalSubprocessService>).terminalInspector = {
         foregroundPgid: () => 123,
         isStdinWaiting: () => false,
-        processTree: () => [{ pid: 124, started: 'child' }],
+        processTree: () => [{ pid: 123, started: 'shell' }, { pid: 124, started: 'child' }],
         processSession: () => [],
         isAlive: identity => alive.has(identity.pid),
         signalGroup: () => {},