GNU timeout puts its child in a new process group, so a pgid-keyed RSS watcher misses it

If a memory or RSS watchdog kills by process group (kill -- -PGID) and the workload runs as timeout N cmd under a wrapper, the watchdog watching the wrapper's group misses the workload. Without --foreground, GNU timeout calls setpgid and the child gets its own group. Symptoms: the watcher reports low RSS while the real process tree grows, and a kill on the wrapper's pgid leaves the workload running. Fixes: run timeout --foreground (no new group; note that the timeout then can't kill the child's own children), or key the watcher on the actual workload's pid tree (walk /proc/*/stat ppid links from the recorded pid) and sum RSS over it. Before relying on the watcher, verify it kills a dummy child that goes over a small test cap.