fix: orphan process cleanup, graceful shutdown, security hardening

Orphan process prevention:
- Broker: add SIGINT/SIGTERM handler that kills all registered peer
  processes and closes DB cleanly before exit
- Orchestrator: add shutdown handler that kills all managed agent
  processes and CodexDriver instances
- cleanStalePeers: also kill orphan peers with no session idle >5min
  (catches multiagents-peer adapters orphaned by codex mcp-server)
- end_session/delete_session: kill CodexDriver processes + clean
  driver-mode sentinel file

CodexDriver respawn fix:
- recovery.ts respawnAgent: use CodexDriver for codex agents instead
  of falling back to codex exec (which exits after one turn)
- Return CodexDriver from respawnAgent so orchestrator can track it
- handleEvent: re-add respawned CodexDriver to activeCodexDrivers map

Security:
- Sanitize inbox filenames in codex/gemini adapters to prevent
  path traversal via display_name

Dashboard:
- resolveSlots: properly handle driver-managed Codex slots that have
  status=connected but no peer_id