test support: await fork descendants in formula runs

[brandonpayton]

Purpose

Let Formula tests prove detached fork behavior without destroying the Kandelo host as soon as the original parent exits. This support is required for durable GNU Wget --background coverage and is intentionally split from the Wget Formula PR.

Root cause

kandelo_run_wasm previously waited only for the root process. A correctly detached parent can return success while its fork child is still downloading or writing output; the runner then destroys NodeKernelHost, so sleeps or post-run file checks cannot distinguish a real completed child from premature teardown.

Change

• Add opt-in expected_fork_descendants: to the tap Formula helper, with a nonnegative-integer contract.
• Pass the expectation as inert runner configuration.
• Track kernel fork process events while ignoring the synthetic root spawn.
• After a successful root exit, keep the host alive until at least the requested number of fork descendants has been observed and every observed fork descendant has exited.
• Fail on timeout or any nonzero descendant exit status, using the same bounded process deadline.

The name is deliberately fork-specific: Kandelo process events include a parent PID for fork, while posix_spawn is a separate lifecycle path. No platform event semantics are inferred or widened here.

Validation

Through Kandelo scripts/dev-shell.sh at 0f12212:

• Shared Formula support: 30 runs, 221 assertions, 0 failures, 0 errors, 0 skips.
• Helper Ruby syntax: passed.
• TypeScript transpile diagnostics: 0 errors.
• Prettier check on run-network-wasm.ts: passed.
• git diff --check: passed.

A full standalone TypeScript typecheck was not claimed because the runner retains the pre-existing Node Response(process.stdin) BodyInit typing mismatch. Wget exact runtime behavior remains in PR #20 and is not claimed by this support-only PR.

This changes no Formula, bottle, sidecar, publisher, Kandelo main runtime, or ABI.

[brandonpayton]

Devil's-advocate review: ACCEPT at 0f12212. The opt-in defaults to zero and preserves the existing runner path. With a positive expectation, a successful root exit is insufficient: the runner requires the requested fork count, waits for every observed fork descendant, rejects nonzero child status, and shares the existing bounded deadline. The contract is correctly fork-specific because only fork events carry parent identity; it makes no false posix_spawn claim. I also checked the timeout reuse, root-spawn exclusion, double-fork behavior, strict Ruby input validation, exact environment handoff, and failure paths. Fresh evidence is 30/221 support assertions, zero TypeScript transpile diagnostics, clean Prettier, Ruby syntax, and diff check.