bridge: shut down + release the port when the parent dies; enforce one bridge per agent

[terafin]

Problem

a2abridge bridge is spawned by an MCP host (Claude Code, Codex, etc.) as a stdio child that also binds an HTTP port for inbound A2A. Two ways a stale/duplicate bridge ends up holding the port so the next bridge can't bind (listen tcp :<port>: bind: address already in use) and the agent's outbound send path goes silently dead:

1. Host exits → the bridge reparents to init (ppid 1) and keeps running, squatting the port.
2. Mid-session respawn (e.g. an MCP reconnect) → a second bridge lingers alongside the first.

Observed across a multi-agent fleet: a stuck bridge held a port for hours, dropping inbound messages with no error surfaced; and a reconnect left a duplicate.

Fix — one bridge per agent, defence-in-depth (all in RunBridge)

1. Linux PR_SET_PDEATHSIG(SIGTERM) (pdeathsig_linux.go): kernel signals the bridge the instant its parent dies, routed into the existing signal.NotifyContext(SIGTERM) graceful shutdown → listener closes, port frees. Set on a dedicated locked OS thread that blocks forever (PR_SET_PDEATHSIG is a per-thread attribute cleared if the setting thread exits, and the Go runtime migrates/retires threads), plus a getppid()==1 born-orphan check for the fork/exec race. No-op stub on non-Linux (pdeathsig_other.go).
2. Shut down when ServeStdio returns: stdin closing means the parent is gone, so shut down even on a clean EOF (err == nil), not only on error.
3. Bind is the singleton lock: retry briefly on EADDRINUSE (covers the port-release race on a fast restart), then if it's still held, defer to the existing bridge and exit cleanly (0) — exactly one bridge serves an agent even if a duplicate is spawned. Non-EADDRINUSE bind errors still fail hard.

(1)+(2) are redundant on purpose (kernel signal vs. stdin EOF). (3) closes both the release race and the duplicate-spawn case.

Verified

• go build ./..., go vet ./..., go test ./internal/cli/... pass; cross-compiles clean for darwin/arm64 + windows/amd64 (platform split holds).
• Die-with-parent: spawned a bridge as a child (stdin held open to isolate pdeathsig), killed the parent → bridge shut down gracefully and released the port; no ppid=1 orphan.
• Singleton: started bridge A holding a port, started bridge B on the same port → B retried, logged port already held by another bridge, deferring, and exited 0, leaving A untouched.

🤖 Generated with Claude Code