Ensure that sandboxed processes exit before their sandboxes are cleaned up

[stuhood]

As @jsirois discovered and described in #16778 (comment), because the local::CommandRunner does not wait for its child process to have exited, it might be possible for a SIGKILL to not have taken effect on the child process before its sandbox has been torn down. And that could result in the process seeing a partial sandbox (and in the case of #16778, potentially cause named cache corruption).

This change ensures that we block to call wait when spawning local processes by wrapping them in the ManagedChild helper that we were already using for interactive processes. It then attempts to clarify the contract of the CapturedWorkdir trait (but in order to improve cherry-pickability does not attempt to adjust it), to make it clear that child processes should fully exit before the run_and_capture_workdir method has returned.

Fixes #16778 🤞.

[stuhood]

Commits are useful to review independently.

It then attempts to clarify the contract of the CapturedWorkdir trait (but in order to improve cherry-pickability does not attempt to adjust it), to make it clear that child processes should fully exit before the run_and_capture_workdir method has returned.

I'll likely open a ticket about this when I have more time, because it's a fairly awkward interface. And one implementation re-uses a single sandbox, two use dedicated sandboxes, etc.