Contain sandbox process descendants in delegated cgroups

[SaladDay]

Sandbox process cancellation now contains descendants that fork, double-fork or call setsid when the existing ScopeCgroupV2 capability is selected. SandboxIO verifies delegation, creates an operation subgroup, and places its trusted trampoline there before target execution. Cancellation kills that subtree and confirms kernel emptiness independently of leader exit and output drain; failed kills continue retrying even while the leader remains alive.

The implementation reuses the process protocol, launch gate, reaper and scope observer. It adds no dependency or public field. Normal background work survives leader exit, and unsupported delegation remains an explicit capability distinction. The existing backend runtime CI job now exercises real delegated cgroups with missing support treated as a failure; the owning English and Chinese documentation is updated.

Validation: real delegated full-package race tests, repeated cancellation/signal/cgroup race tests, focused SandboxIO/process-contract tests, build/vet, naming/docs/CI checks and translation checks. Provider delegation and public stdio cancellation settlement are integrated separately.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}