fix(code-runtime-python): confirm group death at the deadline; chunk the frame read

The reap-poll deadline arm sent SIGKILL then finalized immediately, declaring
quiescence on mere signal delivery while the group was still dying. It now keeps
polling for the group to actually empty (bounded by one more reap margin) after
its self-sent SIGKILL, so `finished` resolves only on a confirmed-empty group.

ProtocolChannel.read_frame read the boot/run handshake frames through
FileIO.readline() on the unbuffered fd — one os.read(1) per byte, so a
multi-megabyte program burned CPU (RLIMIT_CPU already in force for the run frame)
in millions of syscalls before ast.parse. It now reads in chunks into the same
_pending buffer the async reader uses; the wrapping os.fdopen is gone. read_frame
is this PR's own code (e7f22ed3), not the protocol layer. The chunked read is a
syscall-count improvement with no cross-platform-deterministic failure to assert,
noted as such in the Agent Note.

packages/code-runtime/code-runtime-python/src/index.ts

@@ -1095,6 +1095,12 @@ export class PythonCodeRuntime extends CodeRuntime {
           return
         }
         const deadline = Date.now() + this.config.graceMs + CLOSE_REAP_MARGIN_MS
+        // Once the deadline forces us to send SIGKILL ourselves, allow one more
+        // reap window for the kernel to tear the group down before giving up:
+        // SIGKILL is asynchronous, so the group is not gone the instant it is
+        // sent. `finalize` only runs on a confirmed-empty group, except at this
+        // final hard bound where nothing more can be done.
+        let hardDeadline = 0
         const pollGroup = (): void => {
           if (groupEmpty()) {
             // The group is gone; the grace SIGKILL is moot. Cancel it (it may not
@@ -1104,15 +1110,23 @@ export class PythonCodeRuntime extends CodeRuntime {
             finalize()
             return
           }
-          if (Date.now() >= deadline) {
+          if (hardDeadline === 0 && Date.now() >= deadline) {
             // Deadline reached with the group still non-empty. This is reachable
             // when the host event loop was blocked past both timers: Node runs
             // this poll before the grace SIGKILL timer, so that SIGKILL may never
-            // have fired. Send it HERE before finalizing — idempotent if the timer
-            // already ran — so a SIGTERM-ignoring same-group survivor is actually
-            // reaped rather than released by cancelling an unfired escalation.
+            // have fired. Send it HERE (idempotent if the timer already ran) and
+            // keep polling for the group to actually empty — finalizing on mere
+            // signal delivery would declare quiescence while the group is still
+            // dying. Bound the extra wait by one more reap margin.
             killGroup('SIGKILL')
             clearTimeout(graceTimer)
+            hardDeadline = Date.now() + CLOSE_REAP_MARGIN_MS
+          }
+          // Hard bound: only reached if the self-sent SIGKILL never empties the
+          // reachable group (a kernel that never reports ESRCH), which does not
+          // happen in practice — hence the ignore on the branch below.
+          /* v8 ignore next 4 -- SIGKILL empties the reachable group within the reap margin. */
+          if (hardDeadline !== 0 && Date.now() >= hardDeadline) {
             finalize()
             return
           }