Handle SIGINT/SIGTERM in run_process_foreground for -r

Previously, Ctrl-C or `kill` during -r's bwrap run left slocker_lite
killed outright (default signal disposition), skipping
run_container()'s unmount/cleanup entirely and leaving the layer
imported and/or mounted as garbage.

run_process_foreground() now installs a handler around its waitpid()
that forwards the signal to the running child (kill(), async-signal-
safe) and keeps waiting (EINTR-retry loop) instead of dying. Once the
child actually exits, control returns normally so the existing
unmount/cleanup runs as usual.

Verified with a backgrounded `-r ... -- /bin/sleep 30`, sending both
SIGINT and SIGTERM to the outer slocker_lite PID: process tree exits
cleanly, unmount+delete-layer both run, containers-storage layers
returns to baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -38,7 +38,12 @@ Source layout (all under `src/`):
 - `process.{h,cpp}` — argv-based subprocess helpers (fork/execvp, no shell):
   `run_process()` captures stdout (used for `containers-storage` calls),
   `run_process_foreground()` inherits all of stdio (used for the interactive `bwrap`
-  run). Also `find_in_path()`, a shared `$PATH` lookup.
+  run). Also `find_in_path()`, a shared `$PATH` lookup. `run_process_foreground()`
+  installs a SIGINT/SIGTERM handler around its `waitpid()` that forwards the signal
+  to the running child and keeps waiting instead of letting the default disposition
+  kill `slocker_lite` itself — without this, Ctrl-C (or `kill`) during `-r`'s `bwrap`
+  run would skip `run_container()`'s unmount/cleanup entirely, leaving the layer
+  imported and/or mounted.
 
 Errors are logged via `spdlog::error`; every external command is also traced at debug
 level in `run_process()`/`run_process_foreground()` (`src/process.cpp`) — visible via