ExternalProcess: don't kill the process group when a spawned command fails

Two bugs made a failed external command tear down the entire process group:

- The fork child threw cRuntimeError when execvp fails. In the child (a copy of
  the sim process) that unwinds into a full simulation teardown, running
  ~ExternalProcess() with pid==0 -> stopProcess() -> "/bin/kill -SIGTERM 0",
  which SIGTERMs the whole process group. A1: report the errno on the redirected
  stderr and _exit(127) instead of throwing, so the parent just sees the process
  exit and applies its onExit policy. Use _exit (not exit) so the fork child never
  runs the parent's atexit/static destructors.

- stopProcess() guarded only "pid != -1", so pid==0 (or any non-positive value)
  would issue "kill 0" / "kill -1" against the process group. A2: guard "pid > 0".

Surfaced by CI: running INET's module suite concurrently under a single podman-exec
process group, a missing external tool (ping/killall absent from the container)
tripped this and SIGTERM'd the whole run (opp_env included -> exit 143) at ~140/321.
With this fix a missing/failing command fails only its own test.

Author: levy

src/inet/common/ExternalProcess.cc

@@ -8,7 +8,11 @@
 
 #include "inet/common/NetworkNamespaceContext.h"
 
+#include <cerrno>
+#include <cstdio>
+#include <cstring>
 #include <fcntl.h>
+#include <unistd.h>
 
 namespace inet {
 
@@ -115,7 +119,17 @@ void ExternalProcess::startProcess()
         }
         args.push_back(nullptr);
         execvp(args[0], &args[0]);
-        throw cRuntimeError("Failed to execute command");
+        // execvp only returns on failure, and this is the fork child -- a copy of the
+        // simulation process. It must NOT throw: a cRuntimeError here unwinds into a
+        // full simulation teardown *inside the child*, which runs ~ExternalProcess()
+        // with pid==0, whose stopProcess() then executes `/bin/kill -SIGTERM 0` and
+        // SIGTERMs the entire process group (the whole concurrent test run, not just
+        // this command). Report the failure on the (redirected) stderr and _exit()
+        // immediately, so the parent simply observes the process exit and applies its
+        // `onExit` policy. Use _exit (not exit) to skip the parent's atexit/static
+        // destructors, which must never run in the fork child.
+        std::fprintf(stderr, "ExternalProcess: cannot execute '%s': %s\n", command, std::strerror(errno));
+        _exit(127);
     }
     else { // parent process
         close(stdout_pipe[1]);
@@ -135,7 +149,10 @@ void ExternalProcess::startProcess()
 void ExternalProcess::stopProcess()
 {
     EV_DEBUG << "Stopping process: " << command << std::endl;
-    if (pid != -1) {
+    // Only ever kill a real child PID. pid==-1 means "never started"; pid==0 must never
+    // reach here (that is the fork child -- startProcess now _exit()s instead of throwing),
+    // and `kill 0` / `kill -1` would signal the whole process group, not just this command.
+    if (pid > 0) {
         rtScheduler->removeCallback(processStdout, this);
         rtScheduler->removeCallback(processStderr, this);
         std::string prefix = !strncmp("sudo", command, 4) ? "sudo " : "";