feat(build): no fork in multi-threaded XCE processes, enforced by check-no-fork

Design constraint (tech.md "Process Creation"): the controller, scheduler,
xcecd and anything that starts libxce threads never call fork, vfork,
forkpty, daemon, system, popen or uv_spawn; children start with posix_spawn()
or a systemd unit. A process proven single-threaded may fork, marked
/* xce-fork-ok: <why> */. Tests, harness, autoscaler (not finalized; bug-1969)
and the Go frontend are out of scope.

- scripts/check-no-fork.py scans src/{controller,scheduler,lib,worker}
  (comment/string/#if 0 aware); runs as meson test "no-fork rule" in the
  lib/controller/scheduler/worker suites and in the pre-commit hook.
- worker: drop xcecd's unused fork-based worker start paths
  (process_manager_start_process, process_manager_start_worker; xcecd
  starts xcecd_worker over D-Bus) and a dead #if 0 daemonize fork.
- xcecd_worker's fork/uv_spawn/system calls are marked: its call graph
  from main(), callbacks included, reaches no pthread_create or libuv
  thread-pool call.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

scripts/git-hooks/pre-commit

@@ -1,7 +1,19 @@
 #!/bin/sh
 # Refuse commits whose bug records (.wolf/bugs/*.md) do not meet
-# .claude/skills/buglog/bug-record.md, or whose .wolf/buglog.json index is stale.
+# .claude/skills/buglog/bug-record.md, or whose .wolf/buglog.json index is stale;
+# and commits whose staged C sources break the no-fork rule
+# (.kiro/steering/tech.md, "Process creation"; scripts/check-no-fork.py).
 # Install: ln -sf ../../scripts/git-hooks/pre-commit .git/hooks/pre-commit
+top="$(git rev-parse --show-toplevel)"
 if git diff --cached --name-only -- .wolf/bugs/ .wolf/buglog.json | grep -q .; then
-    exec python3 "$(git rev-parse --show-toplevel)/scripts/buglog.py" check --staged
+    python3 "$top/scripts/buglog.py" check --staged || exit 1
 fi
+c_files="$(git diff --cached --name-only --diff-filter=ACMR -- '*.c' '*.h')"
+if [ -n "$c_files" ]; then
+    # shellcheck disable=SC2086 # one path per word; repo paths have no spaces
+    python3 "$top/scripts/check-no-fork.py" "$top" $c_files >/dev/null || {
+        python3 "$top/scripts/check-no-fork.py" "$top" $c_files
+        exit 1
+    }
+fi
+exit 0