claude-current: bound descendants spawned by TERM handlers #153

Late Copilot finding on PR #134 head 2110ff7, filed under the repository's two-round review cap. The review reports that a TERM handler can spawn a descendant after the watchdog snapshots its process tree. That descendant inherits the command-substitution pipe and can keep the bounded call open after the original command exits.

The review's reproduction used a 1-second timeout and a handler running sleep 10 & exit 0, returning after 11 seconds. This follow-up needs a macOS-compatible process-group implementation (or equivalent descendant coverage) for TERM and KILL, with a regression for descendants created by the handler. The current fix rejects timed-out output, but does not address that later descendant.

Source: the “Previously missed” section of the current-head Copilot review on #134, at claude-current:249.