appliance-pid1

The PID-1 duties every distroless nordisk appliance payload owes the kernel, in ONE place: reap orphaned children forever, and idle on a signal instead of a shell. A process that is PID 1 inherits every orphan on the system and is the only process that can reap them; a PID 1 that only `pause()`s accumulates zombies for the life of the appliance and can never notice a child it started has died. `reap_once` is the testable unit (it reports WHAT happened rather than looping), `idle_and_reap` is the never-returning duty a payload's `main` ends with. libc only — a distroless static PID-1 can take this and nothing else.