fix: harden job runner lifecycle and whitelist conformance

Reject fast built-in file tools (fs_* / ast_grep) in job__start per the
backgroundable-tools whitelist; clean up env-snapshot temp files on every
exit of run_process_job via a drop guard; bound the output-pump awaits and
abort them on the failure path; treat signal death (no exit code) as a
failure with a teaching message; bound job__collect's post-drain join with
a SIGKILL escalation so a TERM-ignoring process cannot hang collect after
a Ctrl-C teardown; document the unguarded SIGTERM pid-reuse window; give
the injected Background Jobs prompt section a fresh line on both sides;
extract the MCP server name with strip_prefix instead of replace.

Capacity-0 audit for jobs-disabled contexts: REPL displays have no
supervisor consumers (only Ctrl-C/exit cancel_recursive at
repl/mod.rs:460,473, kind-agnostic); session save/load does not persist
supervisor state (src/config/session.rs has no supervisor references) --
nothing to test for either.

src/config/agent.rs

@@ -462,6 +462,9 @@ impl Agent {
             .iter()
             .any(|f| f.name.starts_with(JOB_FUNCTION_PREFIX))
         {
+            if !output.ends_with('\n') {
+                output.push('\n');
+            }
             output.push_str(DEFAULT_JOB_INSTRUCTIONS);
         }
 

src/config/prompts.rs

@@ -197,7 +197,8 @@ pub(in crate::config) const DEFAULT_JOB_INSTRUCTIONS: &str = indoc! {"
     working instead of blocking. Check progress with `job__check` (sparingly), block on the result
     with `job__collect`, cancel with `job__cancel`, and list jobs with `job__list`. Collect or
     cancel every job you started before ending your turn. Jobs run against a snapshot of the
-    current config/environment and do not survive coyote exiting."
+    current config/environment and do not survive coyote exiting.
+"
 };
 
 pub(in crate::config) const DEFAULT_TEAMMATE_INSTRUCTIONS: &str = indoc! {"

src/config/request_context.rs

@@ -915,8 +915,8 @@ impl RequestContext {
     }
 
     pub fn before_chat_completion(&mut self, input: &Input) -> Result<()> {
-        // The R11 gate in `job__start` validates against exactly what was
-        // declared to the model for THIS request; refresh it every time.
+        // `job__start` validates against exactly what was declared to the
+        // model for THIS request; refresh it every time.
         self.declared_function_names = input.declared_function_names();
         self.last_message = Some(LastMessage::new(input.clone(), String::new()));
         Ok(())