feat(build): no fork in multi-threaded XCE processes, enforced by check-no-fork

Design constraint (tech.md "Process Creation"): the controller, scheduler,
xcecd and anything that starts libxce threads never call fork, vfork,
forkpty, daemon, system, popen or uv_spawn; children start with posix_spawn()
or a systemd unit. A process proven single-threaded may fork, marked
/* xce-fork-ok: <why> */. Tests, harness, autoscaler (not finalized; bug-1969)
and the Go frontend are out of scope.

- scripts/check-no-fork.py scans src/{controller,scheduler,lib,worker}
  (comment/string/#if 0 aware); runs as meson test "no-fork rule" in the
  lib/controller/scheduler/worker suites and in the pre-commit hook.
- worker: drop xcecd's unused fork-based worker start paths
  (process_manager_start_process, process_manager_start_worker; xcecd
  starts xcecd_worker over D-Bus) and a dead #if 0 daemonize fork.
- xcecd_worker's fork/uv_spawn/system calls are marked: its call graph
  from main(), callbacks included, reaches no pthread_create or libuv
  thread-pool call.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/meson.build

@@ -72,6 +72,16 @@ if component != 'xcecli'
   subdir('frontend/apiserver')
   subdir('xceadmin')
 
+  # No-fork rule (.kiro/steering/tech.md, "Process creation"): fails if a
+  # covered component's C code calls fork()/system()/popen()/uv_spawn()
+  # outside a call marked xce-fork-ok. In each covered suite, so
+  # `xce-build.sh <component>` runs it too.
+  test('no-fork rule',
+       find_program('python3'),
+       args: [meson.project_source_root() / '..' / 'scripts' / 'check-no-fork.py',
+              meson.project_source_root() / '..'],
+       suite: ['lib', 'controller', 'scheduler', 'worker'])
+
   configure_file(
     input: 'tools/appimage/entry.sh',
     output: 'xce',