fix(vm): tolerate processes vanishing mid /proc scan

[CMGS]

Problem

Under a 16-way concurrent clone+release burst, vm rm intermittently failed with:

rm: refuse delete: /proc scan errored: read /proc/70367/cmdline: no such process (resolve the host issue and retry)

ScanProcsByBinary walks /proc reading every numeric entry's cmdline before the binary-name filter, so any short-lived process on the host can race the scan. The scan already skipped ENOENT (process gone before open), but a process reaped between open and read surfaces ESRCH from read(2) (fs/proc/base.c returns -ESRCH once the task is gone), which fell through to the fail-closed path and refused the whole batch delete. The same scan backs WithRunningVM's fallback and GC's ensureOrphanVMMDead, so those paths could spuriously fail the same way.

Fix

Gate the fail-closed latch on IsProcessAlive(pid) instead of errno matching: a vanished process cannot be holding the VM's resources, whatever errno its disappearance surfaced; read errors on live processes (EACCES/EIO) still fail closed. The fmt.Errorf wrap is dropped — os.ReadFile's *PathError already carries read /proc/<pid>/cmdline. Hot-path cost: zero — the aliveness probe runs only on the error branch.

ScanProcsByBinary now delegates to an injectable seam so the classification is pinned by deterministic tests: read error + live pid fails closed, read error + vanished pid is skipped, and skipped entries don't drop valid matches.

Verification

• Kernel behavior confirmed in a Linux container: after a child is reaped, read(2) on its already-open cmdline returns ESRCH ("no such process", not matched by fs.ErrNotExist), a fresh open returns ENOENT, and kill(pid, 0) returns ESRCH — the aliveness gate covers both raced errnos.
• go test ./utils/ green on Linux (container) and darwin; new TestScanProcsByBinaryReadErrors passes on Linux.
• make lint 0 issues on both GOOS=linux and GOOS=darwin.

Also bumps the install doc download link to v0.5.1 (release to be published separately).

Fixes #128