fix(process): cancel run-token reads during sampling

Propagate the sample AbortSignal through readProcessRunId to host environment inspection so cancellation can settle a blocked ownership-token read.

Validation: ownership and capture lifecycle suites pass, including an abort-waiting host regression. Native provider runtime behavior was not exercised.

src/process/ProcessOwnership.runId.test.ts

@@ -0,0 +1,28 @@
+import { expect, it } from "vitest";
+
+import type { ProcessOwnershipHost } from "./ProcessOwnership.js";
+import { readProcessRunId } from "./ProcessOwnership.js";
+
+it("passes cancellation through run-token reads", async () => {
+  const controller = new AbortController();
+  const cancellation = new Error("cancelled");
+  const host: ProcessOwnershipHost = {
+    listProcesses: async () => [],
+    environment: async (_pid, signal) => {
+      if (signal === undefined) throw new Error("run-token signal was omitted");
+      return await new Promise<Readonly<Record<string, string>>>(
+        (_resolve, reject) => {
+          signal.addEventListener("abort", () => reject(signal.reason), {
+            once: true,
+          });
+        },
+      );
+    },
+    signalGroup: () => undefined,
+  };
+
+  const reading = readProcessRunId(42, host, controller.signal);
+  controller.abort(cancellation);
+
+  await expect(reading).rejects.toBe(cancellation);
+});

src/process/ProcessOwnership.ts

@@ -223,8 +223,9 @@ const systemWindowsProcessTreeHost: WindowsProcessTreeHost = {
 export const readProcessRunId = async (
   pid: number,
   host: ProcessOwnershipHost = systemHost,
+  signal?: AbortSignal,
 ): Promise<string | undefined> =>
-  (await host.environment(pid)).REA_PROCESS_RUN_ID;
+  (await host.environment(pid, signal)).REA_PROCESS_RUN_ID;
 
 /** Token-validate every rooted POSIX process group before signaling any. */
 export const cleanupOwnedProcessGroup = async (

src/process/capture/ProcessSampling.ts

@@ -358,7 +358,7 @@ const inspectInitializedPtyRoot = async (
     return undefined;
   let observedRunId: string | undefined;
   try {
-    observedRunId = await readProcessRunId(rootPid);
+    observedRunId = await readProcessRunId(rootPid, undefined, signal);
   } catch (cause: unknown) {
     // Unreadable run identity means the root cannot be attributed.
     void cause;