Add regression test: a nohup-backgrounded process doesn't survive a session

Reproduces the user's reported real-world shape end to end with a real
busybox container ("nohup sleep 137 & exit"), verifying via the host's own
/proc that the backgrounded process is actually gone afterward -- checked
by cmdline substring, not pid, since a pid seen inside an isolated pid
namespace doesn't correspond to the same-numbered host pid. A bounded 2s
poll guards against the pid namespace's own kernel collapse-on-pid-1-exit
timing (which already covers this case for free on this dev machine).

Complements test_session_cleanup.cpp's existing [integration][root] test,
which exercises kill_via_cgroup() directly -- this one instead proves the
outward, visible contract holds through the real -r/--run path.

CLAUDE.md

@@ -430,7 +430,27 @@ Source layout (all under `src/`):
     mixes slocker-lite's own status/log output in with the sandboxed
     command's real output; fixed by having the sandboxed command bracket
     its own output between two unique markers and extracting only what's
-    strictly between them.
+    strictly between them. **Also has a regression test for `run_bwrap()`'s
+    own automatic post-exit straggler sweep** (`bwrap.cpp`/`session_cgroup.h`'s
+    "Resolved" entries), reproducing the user's own reported shape end to
+    end with a real container: `nohup sleep 137 & exit` inside the sandbox,
+    then `any_process_cmdline_contains()`/`process_cmdline_gone_within()`
+    (`.cpp`-local, same `/proc`-scanning shape as `bwrap.cpp`'s own
+    `find_fuse_overlayfs_pid()`) confirm the backgrounded process is gone
+    from the *host's* own process table afterward — checked by cmdline
+    substring, not by pid, since a pid seen from inside an isolated pid
+    namespace doesn't correspond to the same-numbered host pid; a bounded
+    (2s) poll guards against the pid namespace's own kernel collapse-on-
+    pid-1-exit guarantee (covering this case for free on any kernel that
+    supports pid namespaces, this dev machine included) not necessarily
+    being synchronously complete by the instant `dispatch_command()`
+    returns. Passing here proves the outward, visible contract ("a stray
+    process never survives a session") end to end, though on a
+    pid-namespace-capable host it doesn't by itself prove the cgroup sweep
+    specifically fired — see `test_session_cleanup.cpp`'s own
+    `[integration][root]` test (below) for one that exercises
+    `kill_via_cgroup()` directly, since the real target device's own
+    no-pid-namespace escape shape can't be forced via the CLI at all.
   - `tests/integration/test_root_networking.cpp` (`[integration][root][net]`)
     — the persistent-netns/tap-relay/dns-resolver tests that originally
     lived directly in this file, ported to tagged `TEST_CASE`s (every