fix: prevent orphan processes in exec timeout test

Use trap + background sleep pattern so the child process handles
SIGTERM cleanly instead of leaving a sleep 60 orphan that causes
GitHub Actions to fail during post-job cleanup.

Author: richiemcilroy

crates/sandchest-agent/src/exec.rs

@@ -418,15 +418,16 @@ mod tests {
     #[tokio::test]
     async fn exec_timeout_kills_process() {
         let mut req = make_request();
-        req.shell_cmd = "sleep 60".into();
+        // Use trap to prevent orphan processes on CI (GHA fails on orphan cleanup)
+        req.shell_cmd = "trap 'exit 143' TERM; sleep 10 & wait".into();
         req.timeout_seconds = 1;
 
         let start = Instant::now();
         let events = collect_exec_events(req).await;
         let elapsed = start.elapsed();
 
-        // Should complete well before the 60s sleep
-        assert!(elapsed < Duration::from_secs(10));
+        // Should complete well before the 10s sleep
+        assert!(elapsed < Duration::from_secs(5));
 
         let exit_event = events
             .iter()
@@ -443,6 +444,9 @@ mod tests {
             "timed-out process should exit with -1 or 143, got {}",
             exit_event.exit_code
         );
+
+        // Brief wait to ensure process is fully reaped (prevents GHA orphan cleanup errors)
+        tokio::time::sleep(Duration::from_millis(100)).await;
     }
 
     #[tokio::test]