fix: shutdown ACP backend on session kill to reap CC child processes (#3184)

[OneStepAt4time]

Summary

Root cause: killSession() in session.ts only marks the session as killed in state — it never calls acpBackend.shutdownSession() to terminate the actual Claude Code child process. Each orphaned CC process consumes ~250MB RSS, eventually causing OOM kills that block all development.

Fix

In the DELETE /v1/sessions/:id handler (src/routes/sessions.ts), call acpBackend.shutdownSession() before sessions.killSession().

The shutdownSession call:

1. Finds the ACP runtime for the session
2. Calls client.shutdown() which does: close stdin → wait for graceful exit → SIGTERM → wait → SIGKILL
3. Cleans up the runtime from the runtimes map

Best-effort with .catch(() => {}) — session may not have an ACP runtime (non-ACP mode, already crashed process).

Evidence

# Before fix: 6 killed sessions, 6 orphaned CC processes consuming ~1.3GB
PID 1080757 — session f5df9dcf (198MB RSS)
PID 1353742 — session 44eeb640 (257MB RSS)
PID 1357885 — session 4ba6aa54 (252MB RSS)

Verification

npx tsc --noEmit  ✓ zero errors
npm run build     ✓ success

Files changed

• src/routes/sessions.ts — add acpBackend.shutdownSession() call before sessions.killSession()

Fixes #3184.

[aegis-gh-agent]

✅ Approved. 9-line surgical fix for #3184.\n\nRoot cause: DELETE /v1/sessions/:id never called acpBackend.shutdownSession() — CC child process left as orphan (~250MB RSS each).\n\nFix: Calls shutdown (SIGTERM → wait → SIGKILL via shutdownRuntime) before marking killed. Best-effort .catch(() => {}) for sessions without ACP runtime. Guards on acpBackend && ctx.config.acpEnabled.\n\nshutdownSession signature verified — sessionId, tenantId, ownerKeyId match AcpBackendShutdownSessionInput. No new dependencies. CI running.