fix(executor): terminate action process groups

[daryllimyt]

Summary

• Start direct and unsafe action subprocesses in dedicated process sessions.
• Terminate and reap the subprocess group as soon as its leader exits, or on timeout or cancellation, before the registry-artifact lease can be released.
• Observe leader exit independently of stdout and stderr so a background descendant holding inherited pipes cannot delay cleanup.
• Share the process-group communication and cleanup logic between the direct action runner and unsafe PID executor.

This is the correctness prerequisite for #3139: active action processes must be gone before their registry-artifact lease is released and the cache entry becomes eligible for eviction.

Scope

This contains ordinary descendants that remain in the action's process group. Deliberately detached sessions are outside the unsafe fallback's contract; full hostile-code isolation requires nsjail or PID-namespace support. Reaping orphaned grandchildren from a PID-1 worker is separate container-init hygiene because zombies cannot execute against or hold file descriptors into the leased artifact.

Testing

• uv run pytest tests/unit/test_registry_artifacts.py tests/unit/test_action_runner.py tests/unit/test_unsafe_pid_executor.py -q (58 passed)
• Post-restack direct and unsafe PID regression suite (31 passed)
• Inherited-output-pipe regression repeated 20 times (20 passed)
• Ruff check and format clean on all changed Python files
• BasedPyright on all changed Python files (0 errors, 0 warnings)

LOC breakdown

Category	+	-
Logic	68	11
Tests	215	2

Related Issues

ENG-1568

[daryllimyt]

• fix(executor): bound registry artifact cache with leased LRU eviction #3139
• fix(executor): terminate action process groups #3159 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to fe89081.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=b04b9621-8ba2-40c8-8d07-ca3310b499ff&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► tracecat/executor/action_runner.py     Switch to using communicate_process_group for process I/O and start_new_session for subprocesses
Enhancement	► tracecat/sandbox/unsafe_pid_executor.py     Use communicate_process_group, add start_new_session, and include pid namespace related utilities
Enhancement	► tracecat/sandbox/utils.py     Add terminate_process_group and communicate_process_group for handling process groups and timeouts

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7cbc86c20d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18be338ed0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jordan-umusu]

LGTM

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 93cfd41bec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".