Recover legacy attached portal state - #29

Summary

• Add PortalManager.attach_owned_process(...) for the legacy _fake_server_proc compatibility path.
• Capture command argv, process birth identity, and health token when adopting a legacy NetShaper-owned portal child.
• Fail closed and stop the legacy child if command or process identity cannot be established.
• Wire the orchestrator compatibility shim through the public attach API instead of directly mutating PortalManager internals.
• Persist only captured command state for live portal/mitmproxy children, avoiding late Popen.args reads during manifest saves.

Why

PR #28 made process identity immutable after child launch, but the legacy _fake_server_proc shim could still import a live portal process into a fresh PortalManager without _process_identity. If fake_server_ready() succeeded, launch_fake_server() was skipped and no managed portal record was written. This closes that narrow compatibility gap.

Tests

• PortalManager.attach_owned_process(...) captures identity and argv once.
• Attach fails closed when argv or process birth identity cannot be recovered.
• Legacy _fake_server_proc import now produces recoverable portal persistence even when readiness is already true.

Validation

• .venv/bin/python -m pytest tests/test_portal_manager.py tests/test_orchestrator.py tests/test_managers.py -q -> 89 passed, 2 subtests passed
• .venv/bin/python -m coverage run -m pytest -q -> 380 passed, 5 skipped, 16 subtests passed
• .venv/bin/python -m coverage report --fail-under=60 -> total 69.48%
• .venv/bin/python -m coverage report --include='src/netshaper/core/session_plan.py' --fail-under=95 -> 98.63%
• .venv/bin/python -m coverage report --include='src/netshaper/core/session_runner.py' --fail-under=95 -> 97.37%
• .venv/bin/python -m coverage report --include='src/netshaper/core/portal_manager.py' --fail-under=85 -> 88.56%
• .venv/bin/python -m coverage report --include='src/netshaper/core/elevated.py,src/netshaper/core/session_plan.py,src/netshaper/core/session_runner.py' --fail-under=80 -> 97.86%
• .venv/bin/python -m ruff check .
• .venv/bin/python -m mypy
• .venv/bin/python -m bandit -c pyproject.toml -r src/netshaper