fix(testgen): kill the whole subprocess tree on tg start/install shutdown

[aarthy-dk]

Summary

• proc.terminate() on Windows calls TerminateProcess, which kills only the parent and leaves pixeltable-pgserver's postgres.exe children running. The visible symptom is tg delete failing with "Could not remove TestGen data directory" because postgres holds the data files open.
• New stop_app_tree(proc, timeout=...) helper walks the descendant tree: taskkill /F /T /PID on Windows, os.killpg(SIGTERM) (with SIGKILL escalation) on POSIX.
• start_testgen_app now spawns testgen with start_new_session=True on POSIX so the whole group can be signaled together. All three termination sites (port-readiness timeout, KeyboardInterrupt handler, finally cleanup) route through the new helper.

Scope note

This is a force-kill safety net for uncatchable termination paths: installer crash, terminal closed via the X button, hang in testgen, port timeout. Graceful shutdown on Ctrl+C is a complementary fix in pixeltable-pgserver / testgen's own signal handling — that change is happening separately on the TestGen side and doesn't make this one redundant. The two fixes cover different failure modes.

Also in this PR: explicit Docker Compose prereq check

Previously a machine with the docker CLI + a running engine but no Compose plugin (e.g. distro docker.io without docker-compose-plugin) would pass the auto-mode picker's prereq display, then fail later inside ComposeStartStep / docker compose exec.

• New REQ_DOCKER_COMPOSE (probes docker compose version).
• Threaded into every action that actually shells out to docker compose: Obs install/upgrade/delete and the Docker-mode TestGen actions (install/upgrade/start/delete/run-demo/delete-demo). DemoContainerAction and the pip+--export branch of tg run-demo keep the original Docker-only list since those paths only use docker run.
• The auto-mode picker hides REQ_DOCKER from its rendered prereq line (Docker installed is implied by Docker Compose installed) — purely cosmetic; the underlying check still runs so a tg install --docker invocation on a Docker-less box still gets the precise "Install Docker and try again" message.

Test plan

• pytest — 182 passing locally (4 new unit tests for the kill-tree helper covering: no-op when proc already exited, Windows taskkill path, POSIX killpg path, SIGKILL escalation on timeout)
• ruff check + ruff format --check clean
• Reviewer manual check on Windows: install → Ctrl+C → Get-Process postgres -ErrorAction SilentlyContinue (some orphans expected until the testgen-side graceful shutdown lands; this PR ensures the installer's own unilateral termination paths don't leak)
• Reviewer manual check on a Linux box with docker.io but no docker-compose-plugin: tg install should now fail prereq check with "Install the Docker Compose plugin and try again" instead of crashing inside the install steps

🤖 Generated with Claude Code

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
dk-installer.py	1780	414	77%	155–156, 160–161, 173–185, 213–214, 217, 222–226, 236–237, 246–258, 263, 276, 322–323, 382, 422–429, 436, 448, 470–471, 515, 565–568, 587–588, 590, 640–669, 673–706, 737–755, 826, 897–898, 966, 983–984, 1001–1006, 1080–1081, 1091, 1107–1111, 1114, 1117, 1120, 1131–1164, 1267, 1273, 1319, 1322, 1329–1330, 1336–1338, 1438–1449, 1498–1513, 1516–1527, 1544–1545, 1582–1583, 1609–1610, 1617, 1622, 1628–1629, 1662–1665, 1674–1675, 1680–1681, 1697–1708, 1753–1755, 1934–1959, 2000–2003, 2068–2071, 2124, 2149–2151, 2159–2161, 2210, 2212, 2214, 2326–2327, 2345, 2375, 2384, 2387–2389, 2432–2444, 2449–2456, 2464–2474, 2548–2549, 2563, 2609, 2717–2787, 2790–2792, 2795–2797, 2868, 2911–2929, 2933, 2938, 2990–2992, 2995–2997, 3023–3026, 3045–3061, 3064–3066, 3069–3071, 3095–3100, 3109–3111, 3147–3155, 3158–3160, 3168–3172, 3236–3238, 3245–3247, 3258–3261, 3266–3267, 3273–3274, 3285–3294, 3303–3357, 3361–3397, 3401–3416
TOTAL	1780	414	77%

Tests	Skipped	Failures	Errors	Time
182	0 💤	0 ❌	0 🔥	2.526s ⏱️