I'm not sure if this is still relevant, but for future solution seekers who come across this, if nothing else:
Looking through that code, all attempts to kill processes eventually end up in
reaper.cpp, and will (either synchronously or asynchronously) call
pidfd_send_signal to send a KILL signal to the process. It doesn't do anything fancier than that to kill the process; the KILL signal should be sufficient.
If the browser process is killed, then all child processes (renderers, GPU process, everything) will be killed by the OS as well, and there's nothing we can do about it. If a renderer is killed, then I believe that the browser will become aware of this the next time any IPC is attempted, and either Mojo or Chrome IPC will notify the browser of that, through something like OnChannelError -> ProcessDied -> RenderProcessExited-> RenderProcessGone (the method you mentioned above).
For testing this, it should be sufficient to send the same sigkill to the renderer process, without needing to exhaust memory and hope that the lmkd daemon picks the right process to kill. (For testing a whole-browser-got-killed scenario, I'm not sure if there's any way.
https://crbug.com/138855 has been open for 10+ years now. yfriedman@ may know more about the state of browser death tests on Android.)