Signals over IPC, one-shot timers, and the service harness (M17.4)

Signals are statements delivered as coalescing notifications to the
endpoint a process nominates with signal_bind — never a hijacked stack,
never a question (liveness is the zero-length ping the harness answers).
process_signal is supervisor-or-self gated, like kill; unbound targets
accumulate a pending mask delivered on bind. timer_bind is the missing
timed wait: a one-shot deadline landing in the same replyWait as
everything else — what stop(), hello deadlines, and restart backoff are
built from. runtime.service.run folds requests, signals, and
notifications into callbacks; the VFS conversion deletes its hand-rolled
loop and gains the whole lifecycle contract. The signals scenario drives
ping, reload, terminate->exited, the timer, and the deaf-child
deadline->killed path from ring 3. docs/process-lifecycle.md increments
1-4 are now as-built.

docs/m17-m18-plan.md

@@ -39,7 +39,11 @@ only when its definition of green holds.
       bounded ref-counted table, publish on every death;
       `runtime.process.subscribeExits`; VFS handles carry owners and are swept on
       the owner's death; `vfs-client-death` test; suite 50/50)
-- [ ] **M17.4** — signals, timer notifications, `runtime.process`, the service harness
+- [x] **M17.4** — signals, timer notifications, `runtime.process`, the service
+      harness (signal_bind/process_signal + coalescing pending mask; timer_bind
+      on the tick; bindSignals/signalsFrom/sendSignal/stop + timerOnce;
+      runtime.service.run with the zero-length ping; VFS converted; `signals`
+      scenario; suite 51/51)
 - [ ] **merge** `feat/process-lifecycle` → main, push
 - [ ] **M18.1** — device-manager protocol: hello + restart policy (branch `feat/device-manager`)
 - [ ] **merge** `feat/device-manager` → main, push