The out-of-process ui-host (spawned by Basecamp / any app embedding the view
runtime) inherited the parent's process group and had no parent-death cleanup,
so a parent crash could (a) leak a teardown signal into the parent's process
group and (b) leave the host running as an orphan. Mirror logos_host: setsid()
to lead our own group (parent stays foreground/manageable), plus
PR_SET_PDEATHSIG (Linux) + a portable getppid() watchdog so we exit when the
parent dies. Compare against the parent's actual pid (not pid 1) so a parent
that is itself PID 1 (a container) is handled correctly.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>