check_connectivity now runs a two-layer short-circuit probe:
Layer 1: TCP connect to (local_host, local_port) to confirm the
backend service (e.g. Gitea, Next.js) is actually listening.
Layer 2: original SSH auth probe (unchanged).
This fixes the common false-positive where check returned OK while the
tunneled backend was down. Unlike the previously removed _is_port_in_use
bind check (commit 4c9cd00), this uses connect() with correct semantics:
the forward target SHOULD be listening, not free.
Implements build_autossh_cmd, start_tunnel, and stop_tunnel in process.py.
Adds _reap() helper to handle zombie processes in test environments where
the parent process is long-lived (SIGKILL leaves zombies unless waitpid is called).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
