fix: drop the host-substring assertions and explain the empty except

CodeQL flags `"host:port" in message` as incomplete URL sanitisation. It is a
message rather than a URL being authorised, so it is not a vulnerability, but
the check was red and comparing against the sanitiser's own output asserts the
real contract. The signal handler now says why it swallows: the child is
already gone, and shutdown must not fail on what it is cleaning up.

docsgpt/deploy/dev.py

@@ -143,6 +143,8 @@ def _signal(process, number: int) -> None:
             return
         os.killpg(os.getpgid(process.pid), number)
     except (ProcessLookupError, PermissionError, OSError):
+        # The child has already gone, or its group is no longer ours to signal. Either way there is
+        # nothing left to stop, and shutdown must not fail on the thing it is trying to clean up.
         pass