feat(watchdog): proc_blocking alert for orphaned long-lived test processes

Close the observability gap between agent_hung (only tracked jobs by jobs.pid)
and orphaned pytest subprocesses the orchestrator launches itself
(merge_gate.retest_branch / coverage_gate.measure_coverage). On a timeout-kill of
the agent (-9, ORCH-109) the grand-child pytest reparents onto tini and keeps
running for days, starving CPU and failing merge-gate re-test — with no alert.

Strictly inside the observer (watchdog/** + the watchdog compose service):
- watchdog/collectors/proc.py: stdlib-only /proc scan (under pid: host),
  read-only, never-raise -> []; pure parsers split from I/O (tested on a fake
  /proc tree). Never reads /proc/<pid>/environ.
- watchdog/signals.py: pure proc_signals builder, per-entity
  ("proc_blocking", pid), active iff age_s > proc_age_s; actionable RU detail.
- watchdog/core.py: opt-in tick block (gated on proc_enabled -> zero overhead /
  byte-for-byte when off) + RECOVERY synthesis for a vanished process through the
  existing decide()/AlertState (no new anti-spam logic).
- watchdog/config.py: WATCHDOG_PROC_{ENABLED(false),AGE_MIN(60),PATTERNS(pytest),
  COOLDOWN_S(1800)}; default threshold > max(merge_retest_timeout_s=600,
  coverage_run_timeout_s=900) so a legit in-flight run never crosses it.
- docker-compose.yml: pid: host on orchestrator-watchdog ONLY (read-only privilege).

Anti-false-positive and no overlap with agent_hung are by construction (cmdline
scope + age threshold), not fragile cross-namespace PID matching.

Canon synced: WATCHDOG_PROC_* in .env.watchdog.example <-> .env.example block;
documented in LITE_SETUP.md and docs/architecture/README.md (architect). src/**,
/metrics, schema_version, STAGE_TRANSITIONS, QG_CHECKS, check_*, machine-verdict
and the DB schema are untouched; deploy rebuilds only the sidecar, prod
orchestrator is not restarted (NFR-3).

Tests: tests/watchdog/test_proc_blocking_signal.py (TC-01..TC-06),
test_proc_collector.py (/proc parsing), test_tick_proc_blocking_integration.py
(TC-07), plus pid: host and proc-config assertions. Full pytest tests/ green (1930).

Refs: ORCH-111
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/watchdog/test_config_killswitch.py

@@ -67,3 +67,35 @@ def test_malformed_env_degrades_to_default():
     cfg = Config.from_env({"WATCHDOG_INTERVAL_S": "abc", "WATCHDOG_MEM_PCT": ""})
     assert cfg.interval_s == 30.0
     assert cfg.mem_pct == 90.0
+
+
+# -- ORCH-111: proc_blocking config (kill-switch default-off + safe threshold) --
+def test_proc_blocking_defaults_off_and_safe():
+    cfg = Config.from_env({})
+    assert cfg.proc_enabled is False  # opt-in (needs `pid: host`)
+    assert cfg.proc_patterns == ["pytest"]
+    assert cfg.proc_cooldown_s == 1800.0
+    # Cross-invariant (adr-0041 D2): the default age threshold MUST exceed the max
+    # legitimate test-run budget max(merge_retest_timeout_s=600, coverage=900).
+    assert cfg.proc_age_s > 900.0
+
+
+def test_proc_blocking_thresholds_read_from_env():
+    cfg = Config.from_env(
+        {
+            "WATCHDOG_PROC_ENABLED": "true",
+            "WATCHDOG_PROC_AGE_MIN": "45",
+            "WATCHDOG_PROC_PATTERNS": "pytest,coverage run",
+            "WATCHDOG_PROC_COOLDOWN_S": "900",
+        }
+    )
+    assert cfg.proc_enabled is True
+    assert cfg.proc_age_s == 45 * 60.0
+    assert cfg.proc_patterns == ["pytest", "coverage run"]
+    assert cfg.proc_cooldown_s == 900.0
+
+
+def test_proc_blocking_malformed_env_degrades():
+    cfg = Config.from_env({"WATCHDOG_PROC_AGE_MIN": "nope", "WATCHDOG_PROC_ENABLED": ""})
+    assert cfg.proc_age_min == 60.0
+    assert cfg.proc_enabled is False