fix(runtime): recover malformed credential-home lock owners

[mldangelo-oai]

Summary

Recover stale credential-home locks when their recorded owner cannot identify a real process.

Changes

• Accept only positive signed-32-bit integer process IDs before checking whether a lock owner is alive.
• Treat zero, negative, fractional, and out-of-range owner values like other malformed stale lock records.
• Preserve existing live-owner, permission-denied, and stale-lock age behavior.
• Add regression coverage for invalid process IDs and existing lock recovery.

Testing

• bun test --timeout 30000 --only-failures --test-name-pattern 'recovers credential-home locks whose owner names no process|recovers credential-home locks left by exited processes|does not rewrite Windows credential ACLs while polling a held lock' tests-ts/runtime.test.ts — 3 passed, 0 failed.
• bun test --timeout 30000 --only-failures --randomize --seed 12345 ./tests-ts — 1,135 passed, 11 skipped, 0 failed.
• pnpm run types
• pnpm run format
• git diff --check

Risk and rollout

Only invalid owner process IDs change behavior. Legitimate live locks, existing credential protections, and the existing stale-age threshold are unchanged. Recovery of a genuinely reused live process ID remains separate work.

Addresses #228 and replaces #229 on a first-party branch so the complete public CI matrix can run.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 0f067c2484

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0f067c2484

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.