Harden managed service identity recovery

[kiroro123]

Summary

• Capture portal and mitmproxy process identity exactly once immediately after Popen.
• Refuse to keep a managed child running if process_create_time cannot be established at launch.
• Reuse the captured process identity on later manifest saves instead of recalculating it during every save_state().
• Re-check process birth time on the same psutil.Process object before trusting cmdline metadata or sending a termination signal during recovery.

Why

PR #27 added managed child-service recovery. This follow-up closes the next edge case: a later transient psutil failure during manifest persistence could overwrite a previously good process_create_time with None, turning a recoverable child into an unverifiable child after a parent SIGKILL. This PR makes child process ownership immutable for the lifetime of the child.

Tests

• Adds regression coverage that persistence does not re-read process identity after it has been captured.
• Adds launch-failure coverage for portal and mitmproxy when process birth identity cannot be captured.
• Adds recovery coverage for birth-time mismatch before cmdline/signaling.
• Adds a harmless live child recovery test that terminates the recorded PID/create-time and leaves an unrelated process alive.

Validation

• .venv/bin/python -m pytest tests/test_managers.py tests/test_portal_manager.py tests/test_orchestrator.py -q -> 85 passed, 2 subtests passed
• .venv/bin/python -m coverage run -m pytest -q -> 376 passed, 5 skipped, 16 subtests passed
• .venv/bin/python -m coverage report --fail-under=60 -> total 69.44%
• .venv/bin/python -m coverage report --include='src/netshaper/core/session_plan.py' --fail-under=95 -> 98.63%
• .venv/bin/python -m coverage report --include='src/netshaper/core/session_runner.py' --fail-under=95 -> 97.37%
• .venv/bin/python -m coverage report --include='src/netshaper/core/portal_manager.py' --fail-under=85 -> 91.93%
• .venv/bin/python -m coverage report --include='src/netshaper/core/elevated.py,src/netshaper/core/session_plan.py,src/netshaper/core/session_runner.py' --fail-under=80 -> 97.86%
• .venv/bin/python -m ruff check .
• .venv/bin/python -m mypy
• .venv/bin/python -m bandit -c pyproject.toml -r src/netshaper