fix: don't wait forever for a child that ignores SIGTERM

[ykhrustalev]

Problem
On a timeout, terminate() sends one SIGTERM and then blocks in wait() with no bound. A cargo process that ignores the signal, or that has been stopped and so never receives it, hangs the whole run at that point.

Solution

• Waits only a short grace period after SIGTERM, then SIGKILLs the process group.
• Moves the killpg errno handling into a signal_group() helper, since two signals are now sent.

Testing

• Existing timeout and interrupt tests pass unchanged on macOS and Linux.
• No new test: reaching the escalation needs the cargo process itself to ignore or not receive SIGTERM, which cargo doesn't do in normal operation (it is reachable via SIGSTOP).

Split out of #647 as requested. This is the first of a series and stands on its own; next in the stack: #650 (process-group sweep) → #652 (report why a scenario died).