feat(supervisor): one-for-one supervisor with restart policies + intensity cap

Builds on the existing supervisor_channel funnel (one mailbox per
supervisor; better than N monitor channels given there is no select).

- supervisor.rs: Restart{Permanent,Transient,Temporary}, ChildSpec (an
  Fn factory so children can be re-instantiated), and OneForOne with a
  builder (child/intensity) and run() supervision loop. Restart decision
  keys off whether the Signal was a panic; a sliding-window intensity cap
  stops crash loops and returns instead of spinning.
- Does NOT forcibly terminate children: shared-heap + Drop make async
  teardown of a peer unsound, so one_for_all/rest_for_one and true links
  wait on a cooperative-cancellation primitive. Cap-trip just stops
  restarting; live children are left as-is.

tests/supervisor.rs: transient restart-then-settle, transient/temporary
no-restart, permanent crash-loop hitting the cap, and one-for-one
isolation across two children. Full suite green.

src/lib.rs

@@ -46,7 +46,7 @@ pub use scheduler::{
     block_on_io, run, self_pid, sleep, spawn, spawn_under, wait_readable, wait_writable,
     yield_now, JoinError, JoinHandle,
 };
-pub use supervisor::Signal;
+pub use supervisor::{ChildSpec, OneForOne, Restart, Signal};
 
 // ---------------------------------------------------------------------------
 // check!()