Stop a go2rtc that outlived a hard-killed proxy

SIGTERM already stops go2rtc (the signal handler), but SIGKILL and the OOM
killer give the proxy no chance to, and the orphan keeps :1984/:8555 bound
and a printer's access code in memory.

Two layers, neither needing unsafe or a new dependency:

- The watchdog records go2rtc's pid next to its config and, on startup,
  stops a leftover. It acts only if /proc confirms the pid is still *our*
  go2rtc - the configured binary on our own `-config` path - so a reused pid
  or another proxy's go2rtc is never touched; without /proc it does nothing.
  The pid file is removed when the supervisor goes away.
- deploy/continuum-proxy.service, whose KillMode=control-group (written out,
  with the reason) makes systemd kill the whole cgroup when the proxy dies.
  Syntax-checked with systemd-analyze only; not run under a real systemd.

Tests: the identity check, and a real stand-in process - a leftover is
terminated while an unrelated `sleep` survives. Making the identity check
always say yes fails both, so they do guard the behaviour.

README.md

@@ -110,6 +110,8 @@ src/
   uplink/                WebSocket client to continuum-backend: connect, heartbeat, reconnect on drop
   camera.rs             Writes go2rtc's config from the camera URLs the printers report
   go2rtc.rs             Restarts the go2rtc camera-restreaming process if it dies, or when the config changes
+                        and stops one a hard-killed proxy left behind (pid file next to its config)
+  deploy/               systemd unit template; its KillMode=control-group is what stops go2rtc outliving a SIGKILL'd proxy
   printer/
     mod.rs               GenericPrinter trait + PrinterBase + PrinterHandle enum - the trait+enum
                          "inheritance" pattern this project uses instead of class inheritance