SIGTERM already stops go2rtc (the signal handler), but SIGKILL and the OOM
killer give the proxy no chance to, and the orphan keeps :1984/:8555 bound
and a printer's access code in memory.
Two layers, neither needing unsafe or a new dependency:
- The watchdog records go2rtc's pid next to its config and, on startup,
stops a leftover. It acts only if /proc confirms the pid is still *our*
go2rtc - the configured binary on our own `-config` path - so a reused pid
or another proxy's go2rtc is never touched; without /proc it does nothing.
The pid file is removed when the supervisor goes away.
- deploy/continuum-proxy.service, whose KillMode=control-group (written out,
with the reason) makes systemd kill the whole cgroup when the proxy dies.
Syntax-checked with systemd-analyze only; not run under a real systemd.
Tests: the identity check, and a real stand-in process - a leftover is
terminated while an unrelated `sleep` survives. Making the identity check
always say yes fails both, so they do guard the behaviour.
