fix(browse): Xvfb identity is argv[0]'s basename, not a cmdline substring

First Linux CI run: isOurXvfb identified the TEST RUNNER as our Xvfb —
the suite's own argv contains 'xvfb.test.ts', the substring match over
the whole cmdline passed, and the start-time check matched because the
pid was real. Any process whose ARGUMENTS mention xvfb (a runner, an
editor) was killable — the sibling-kill class the identity check
exists to prevent. Identity now rests on argv[0]'s basename ('Xvfb'),
with a sh-$0 regression pin. isDisplayFree falls back to the X
socket/lock files when xdpyinfo isn't installed (x11-utils is absent
on some images that ship Xvfb).

browse/src/xvfb.ts

@@ -58,11 +58,18 @@ export function shouldSpawnXvfb(env: NodeJS.ProcessEnv, platform: NodeJS.Platfor
  */
 export function isDisplayFree(displayNum: number): boolean {
   // xdpyinfo exits 0 if a display is reachable. Exit non-zero means no
-  // server, which is what we want.
-  const result = Bun.spawnSync(['xdpyinfo', '-display', `:${displayNum}`], {
-    stdout: 'ignore', stderr: 'ignore', timeout: 2000,
-  });
-  return result.exitCode !== 0;
+  // server, which is what we want. xdpyinfo ships in x11-utils, which some
+  // images with Xvfb still lack (first Linux CI run: ENOENT) — fall back to
+  // the X socket/lock files, the same signal X servers themselves use.
+  try {
+    const result = Bun.spawnSync(['xdpyinfo', '-display', `:${displayNum}`], {
+      stdout: 'ignore', stderr: 'ignore', timeout: 2000,
+    });
+    return result.exitCode !== 0;
+  } catch {
+    return !fs.existsSync(`/tmp/.X11-unix/X${displayNum}`)
+      && !fs.existsSync(`/tmp/.X${displayNum}-lock`);
+  }
 }
 
 /**
@@ -106,16 +113,34 @@ export function readPidCmdline(pid: number): string {
   }
 }
 
+/**
+ * Read argv[0] of a PID via /proc/<pid>/cmdline (NUL-separated). Returns
+ * empty string if the process is gone or the cmdline isn't readable.
+ */
+export function readPidArgv0(pid: number): string {
+  try {
+    const raw = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf-8');
+    return raw.split('\0', 1)[0] ?? '';
+  } catch {
+    return '';
+  }
+}
+
 /**
  * Validate that PID is still our Xvfb child. Both checks must pass:
- *   1. /proc/<pid>/cmdline contains 'Xvfb' (string match — Xvfb's argv[0] is
- *      always 'Xvfb' or a full path ending in /Xvfb)
+ *   1. argv[0]'s basename IS the Xvfb binary. A substring match over the
+ *      whole cmdline is identity-kill poison: any process whose ARGUMENTS
+ *      mention xvfb (the test runner executing xvfb.test.ts, an editor with
+ *      the file open) would pass and become killable. First Linux CI run
+ *      caught exactly that — the suite identified itself as our Xvfb.
  *   2. Start time matches the recorded value (PID reuse defense)
  */
 export function isOurXvfb(pid: number, recordedStartTime: string): boolean {
   if (!pid || !recordedStartTime) return false;
-  const cmdline = readPidCmdline(pid);
-  if (!cmdline.toLowerCase().includes('xvfb')) return false;
+  const argv0 = readPidArgv0(pid);
+  if (!argv0) return false;
+  const base = argv0.split('/').pop() ?? '';
+  if (base.toLowerCase() !== 'xvfb') return false;
   const currentStart = readPidStartTime(pid);
   if (!currentStart) return false;
   return currentStart === recordedStartTime;