SIGTERM, SIGHUP, and SIGINT now raise SystemExit, so the finally block
restores main.cjs and the renamed server entry and stops every spawned
process, including the recorder. Spawns defer signals until the child is
tracked.

The manifest no longer hardcodes head/base commits. --head-source and
--base-source are required, resolved with git rev-parse, and recorded
with each saved bundle's hash. Missing refs, bundles, or entry state are
rejected before the checkout is touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>