Big process refactor

This is a large change which makes startProcess() responsible for shutting
its own process down, rather than having a global map.

This makes it much easier to reason about who owns what and get the
synchronization right.

The main immediate bugfix is that now we only attempt to send SIGKILL to
processes which haven't yet shut down, making it clearer which processes
are responsible for a delayed shutdown.

It is a stepping stone to other bug fixes, such as fixing race conditions with
output near process exit.