Timeout the provider process group, not only its launcher

When a lifecycle watchdog invokes a command through a launcher, timing out the launcher alone may leave the actual provider client alive. Repeated attempts can then accumulate children, so the advertised timeout does not bound the operation. Start each call in a dedicated process group, terminate that group on timeout, escalate to a kill after a grace period, and reap the parent. Test with a parent that spawns a child, and check the known child PID directly: a failed process-listing command is not proof of termination. Descendants that deliberately escape the group require stronger containment.

Applies when: Shutdown guards or other safety-critical scripts invoke provider CLIs through wrappers. Keywords: watchdog timeout subprocess launcher descendants process group cleanup liveness