Treat SIGKILL zombies as dead in recover tests

Why: CI containers run a PID 1 that does not reap orphans, so the
killed stub lingers as a zombie and os.kill(pid, 0) keeps succeeding;
local dev machines reap instantly, which hid the difference.

Evidence: tests/test_svc_recover 10/10 after the fix; make
test-governance re-run recorded on the task card; CI on the new head
is the authoritative gate.

Impact: test helper only (svc.sh already treats zombies as dead via
empty-cmdline pidcheck).

Refs: .task/feature-svc-autorecover.md

tests/test_svc_recover.py

@@ -207,9 +207,17 @@ class SvcAutoRecoverTests(unittest.TestCase):
             return False
         try:
             os.kill(pid, 0)
-            return True
         except (ProcessLookupError, PermissionError):
             return False
+        # SIGKILL 后的孤儿在 CI 容器里可能成僵尸（PID 1 不收割）——僵尸按死处理，
+        # 与 svc.sh pid_alive_mark 的口径一致（僵尸 cmdline 为空 = 不匹配 = 已死）。
+        try:
+            state = Path("/proc/%d/stat" % pid).read_text().rsplit(")", 1)[1].split()[0]
+            if state == "Z":
+                return False
+        except (OSError, IndexError):
+            pass
+        return True
 
     def kill9(self, name):
         """SIGKILL 服务主进程（模拟 OOM killer），保留 pidfile 与登记。"""