Fix flaky browser profile cleanup in public checks

[jonabur]

Public checks could fail after every browser assertion passed because a Chrome child was still writing to its temporary profile when Python removed the directory. This caused the Directory not empty failure in PR #10's first CI attempt.

Start Chrome in its own POSIX process group and stop the group before removing the profile, even if the browser parent has already exited. Allow 10 seconds for graceful termination, then kill remaining processes and allow another 10 seconds for exit. Ignore zombies, which cannot write files, while still reporting live processes that cannot be stopped. Preserve the existing parent-process cleanup on non-POSIX systems.

Validation:

• A real subprocess regression reproduces the failure with the old parent-only cleanup and passes with the fix. It covers children that exit gracefully or ignore termination, with and without a live parent.
• Regression coverage for zombies, unrelated process groups, signal races, cleanup failures, and propagation of browser-test failures.
• Full python3 -m tests.check passes, including the real Chrome browser checks. Browser and production-data assertions are unchanged.