fix(verification): retain orphan checks on clean Linux runners

scripts/lib/clean-linux-hopper-runtime.d.mts

@@ -0,0 +1 @@
+export function assertCleanLinuxHopperRuntime(): Promise<void>;

scripts/lib/clean-linux-hopper-runtime.mjs

@@ -0,0 +1,15 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * Observe leftover demo processes on a dedicated clean Linux runner, including
+ * groups reparented after their launcher exits. This is not ownership proof and
+ * never authorizes signaling; unrelated runtime processes also block this lane.
+ */
+export const assertCleanLinuxHopperRuntime = async () => {
+  const { stdout } = await execFileAsync("ps", ["-ax", "-o", "command="]);
+  if (/\/opt\/hopper\/bin\/Hopper|\bXvfb\b|hopper-demo-x11\.py/u.test(stdout))
+    throw new Error("Clean Linux runner retained a Hopper demo process");
+};

scripts/verify-linux-setup-e2e.mjs

@@ -12,6 +12,7 @@ import { tmpdir } from "node:os";
 import { promisify } from "node:util";
 
 import { completeVerifierRun, createVerifierRun } from "./lib/verifier-run.mjs";
+import { assertCleanLinuxHopperRuntime } from "./lib/clean-linux-hopper-runtime.mjs";
 
 const execFileAsync = promisify(execFile);
 const verifierRun = createVerifierRun();
@@ -19,6 +20,7 @@ const command = process.env.REA_VERIFY_SERVER_COMMAND;
 if (process.platform !== "linux" || process.getuid?.() !== 0)
   throw new Error("Linux setup verification requires a root Linux runner");
 if (!command) throw new Error("REA_VERIFY_SERVER_COMMAND is required");
+await assertCleanLinuxHopperRuntime();
 try {
   await access("/opt/hopper/bin/Hopper");
   throw new Error("Linux setup verification requires a clean runner");
@@ -110,6 +112,7 @@ if (
   repeated.appliedActions.length !== 0
 )
   throw new Error("a second setup was not idempotent");
+await assertCleanLinuxHopperRuntime();
 const completedVerifierRun = await completeVerifierRun(verifierRun);
 if (
   completedVerifierRun.process_lineage.status !== "verified" ||