kernel+tests: M4 shared-fate — nine group-death test cases, per-space arena cursors

Eight new QEMU cases (thread-fault-group, kill-threaded-group,
kill-via-worker-tid, racing-triggers, exit-group, leader-thread-exit,
thread-exit-solo, shm-mapping-ref) driving seven new thread-test modes; a
shared checkGroupDead asserts the contract everywhere: one notification,
badged with the leader, reason on the leader's record, no member listed,
claims released first.

The shm-mapping-ref case flushed out the per-task DMA/shared-memory arena
cursor bug directly (a sibling's regions mapped over the worker's), so both
cursors moved to the AddressSpaceRef like the mmap/MMIO cursors before them
(threading M7 pattern). Runtime gains Thread.tryExitCurrent for the leader
-EPERM refusal path. Docs updated: threading.md's shared-fate gap is closed,
process-management.md and process-lifecycle.md describe the leader re-key,
plan status = implemented. Full suite: 100/100.

docs/shared-fate-plan.md

@@ -1,7 +1,11 @@
 # Shared fate: whole-process death (plan)
 
-**Status: approved 2026-07-22; leader `thread_exit` → `-EPERM`. Implementation in
-progress (M1–M4 below).**
+**Status: implemented 2026-07-22 (branch shared-fate), M1–M4 all landed; leader
+`thread_exit` → `-EPERM` as decided. One scope addition forced by M4: the
+per-task DMA/shared-memory arena cursors moved to the per-space object (the
+`shm-mapping-ref` test could not distinguish corruption-by-remap from
+corruption-by-free while sibling threads overlapped the arena) — the same move
+the mmap/MMIO cursors made in threading M7.**
 
 [threading.md](threading.md) promises that a process dies *whole* — a fault in any
 thread, or a kill, takes down every thread. The kernel doesn't do that yet: every
@@ -244,10 +248,10 @@ refcount, and no group-kill special case is needed at all.
   `.ready` with `in_system_call = true`, and the tick's reap loop will reap it —
   an existing hazard the fan-out inherits but must not add new instances of.
   Filed to investigate separately.
-- **Per-task DMA/shm cursors** (`dma_map_next`, `shared_memory_map_next`): two
-  sibling threads allocating overlap the same arena — pre-existing thread bug,
-  adjacent to but not part of this plan (the mmap/MMIO cursors already moved
-  per-space for exactly this reason).
+- **Per-task DMA/shm cursors** — *fixed during M4 after all*: the
+  `shm-mapping-ref` test tripped the overlap (the sibling's churn regions mapped
+  over the worker's region), so both cursors moved to the `AddressSpaceRef`
+  like the mmap/MMIO cursors before them.
 
 ## Milestones