fix(host): contain capture owners and fail closed

Bound the libpipewire router shutdown without detaching its OS handle, contain GStreamer and pactl children in parent-bound process groups, and make ownership failures terminal through the capture supervisor.\n\nAdd focused lifecycle tests plus a serialized live router teardown gate.

src/host/capture.rs

@@ -8,18 +8,20 @@ use anyhow::Result;
 
 use crate::cli::HostOpts;
 use crate::common::display::DisplayServer;
+use crate::host::health;
 use crate::host::pipeline::CaptureHandle;
 use crate::host::quality::EffectiveQuality;
 use crate::host::{wayland, x11};
 
-pub async fn spawn(
+pub(super) async fn spawn(
     display: DisplayServer,
     opts: &HostOpts,
     quality: &EffectiveQuality,
+    health: health::Reporter,
 ) -> Result<CaptureHandle> {
     match display {
-        DisplayServer::Wayland => wayland::start(opts, quality).await,
-        DisplayServer::X11 => x11::start(opts, quality).await,
+        DisplayServer::Wayland => wayland::start(opts, quality, health).await,
+        DisplayServer::X11 => x11::start(opts, quality, health).await,
         DisplayServer::Unknown => unreachable!("caller guarantees display != Unknown"),
     }
 }