Test suite leaks ~50 app-server-broker processes per full run

Summary

Running the full test suite on pristine main leaks roughly 50 app-server-broker processes per run (plus their fake codex app-server children). The processes survive test completion indefinitely; a development machine that ran the suite repeatedly over one afternoon accumulated 200+ leaked broker processes.

Reproduction

1. Fresh checkout of main, npm install.
2. Baseline: pgrep -fl app-server-broker | wc -l.
3. npm test (all tests pass).
4. Count again: ~50 new app-server-broker processes, each holding a unix socket under a cxc-* temp session dir, with fake codex app-server children from the test fixtures.

A control run confirmed the leak comes from tests that spawn a shared broker (any test path calling ensureBrokerSession via review/task against the fake codex) and finish without a SessionEnd/broker/shutdown, so nothing ever retires the broker. Tests that explicitly exercise SessionEnd teardown do clean up after themselves.

Impact

• Every full-suite run permanently leaks ~50 processes and their temp session dirs until the machine is rebooted or they are killed manually.
• CI and developer machines accumulate unbounded broker processes; local port/socket and process-table clutter can eventually cause unrelated test flakiness.

Suggested fix shape

A shared after/teardown helper in the test harness that, per temp workspace, sends broker/shutdown to any loadBrokerSession endpoint and kills the recorded pid — or a fixture-level registry of spawned brokers reaped at process exit.

Provenance

Surfaced while reproducing #612 on pristine main; the leak exists independently of that bug and of PR #623 (whose own new tests tear their brokers down).