Record and expose how every process ends (M17.2)

The kernel records an ExitReason at all three death sites — clean exit,
fault (classified by vector), and process_kill — into a bounded ring
before the exit notification posts, so a supervisor's query never races
the notice. process_exit_reason is gated by the same supervisor check as
kill; runtime.process.exitReason is the stable interface. This is the
input restart policy reads (docs/process-lifecycle.md iron rule 2).

docs/m17-m18-plan.md

@@ -32,7 +32,9 @@ only when its definition of green holds.
 - [x] **M17.1** — kernel releases claims/MSI on death (claims: `releaseAllOwnedBy`
       in the reap; MSI was already swept by `irq.releaseOwner`; `claim-release`
       test; suite 49/49)
-- [ ] **M17.2** — exit reasons
+- [x] **M17.2** — exit reasons (`ExitReason` recorded at exit/fault/kill before
+      the notification; `process_exit_reason` supervisor-gated;
+      `runtime.process.exitReason`; kernel + ring-3 assertions; suite 49/49)
 - [ ] **M17.3** — published exit events + VFS subscriber
 - [ ] **M17.4** — signals, timer notifications, `runtime.process`, the service harness
 - [ ] **merge** `feat/process-lifecycle` → main, push