test(release): await publication helper cleanup

[rynfar]

Problem

Preview run 33542756415 passed the consumer locking assertions in offline pack (b), then fixture cleanup failed with ENOTEMPTY while removing its unique pylon-consumer-lock-* directory.

Root cause

The publication test did not own child-process lifetime at fixture scope. A helper error could settle before close, and a rejected concurrent helper could leave sibling writers running while the test entered finally. The live proper-lockfile fixtures also kept their timer-backed writer in the test process without an explicit process and file-handle quiescence boundary.

Fix

• Track every spawned helper by its exact ChildProcess handle and settle helper results only after close.
• Run live legacy-lock owners in captured subprocesses with deterministic stdin/stdout barriers.
• On failure, terminate only captured live handles, await every close, then run the strict fixture removal once.
• Prove helper completion includes a final async write, sync, file-handle close, process close, and no later recreation.

Verification

• npm run test:pylon-publication (3 consecutive passes, 33/33 each)
• Two concurrent independent node --test scripts/pylon-publication.test.mjs copies (both pass, 33/33 each)
• npm run test:pylon-release (10/10)
• npm run test:pylon-ruleset-auditor-app (6/6)
• npm run check
• git diff --cached --check

OpenAI Codex GPT-5.6 / Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}