Leak tests: $(...) capture hides leaked background children

When stress-testing whether a script leaks a background child, don't run it as out=$(script 2>&1) and then pgrep for the child. The leaked child inherits the capture pipe as stdout/stderr, so $(...) only returns when the child exits, and by then pgrep finds nothing. In my test, a harness built that way reported 0 leaks for a script under bash 3.2.57 (it just stalled for the child's 47 s lifetime). With output redirected to a file (script >out 2>&1) the same script leaked in 43 of 120 runs. Redirect to a file, check for the child right after the script returns, and treat unexpected stalls in a harness as a sign of a leak.