refactor: share owner guardian supervision primitive

[codeforester]

Summary

Extract the FIFO owner-guardian lifecycle into lib_std.sh, including readiness signaling, PID-recycling-safe parent checks, stop/wait handling, and cleanup ordering. The GitHub retry-capture guardian now uses the shared primitive through a small cleanup adapter. The timeout supervisor keeps its existing process-group watchdog path, avoiding a second per-command guardian process while retaining the established TERM/KILL timeout contract.

Issue

Fixes #395

Validation

• git diff --check
• shfmt -d -ln bash -i 4 -sr lib/bash/std/lib_std.sh lib/bash/gh/lib_gh.sh
• bats lib/bash/std/tests/lib_std.bats (227/227)
• bats lib/bash/gh/tests/lib_gh.bats (71/71)
• tests/artifact-contract.sh (five consecutive runs passed across source, generated, vendored, standalone, and project-kit modes)
• env -u BASE_HOME BASE_CACHE_DIR=/private/tmp/base-bash-train-395-final-clean ./tests/validate.sh (615 BATS tests and every repository contract passed)

Demo Impact

None.

Docs Impact

None; this is an internal supervision refactor with no new public command or option.

API Impact

No public API change. A namespaced internal stdlib primitive now centralizes owner liveness, FIFO control, readiness, and stop semantics for asynchronous helpers.

CI Impact

The GitHub capture guardian suite exercises the shared implementation; the timeout path retains its existing process-group behavior and avoids extra per-command process overhead.

Security Notes

The shared guardian preserves the existing reparenting check and PID-recycling protection, closes inherited FIFO descriptors, and performs cleanup only after removing the control channel. The timeout supervisor continues to isolate and escalate the supervised command group.

Notes

Caller-specific behavior remains in adapters: GitHub removes its capture workspace, while timeout retains the established deadline and process-group escalation path.

Checklist

• Branch name follows <category>/<issue>-<YYYYMMDD>-<slug>.
• Branch category matches the issue label.
• Pull request is scoped to one issue.
• Pull request body explains changes and validation.
• Impact sections are complete.
• Pull request includes Fixes #395.