run() kills its child on cancel and on timeout, but both need this process to
be alive to act. SIGKILLed -- an OOM, a container stop, an interrupted test run
-- no finally block runs, the child is reparented to init, and nothing owns it
any more. That is not a dormant process: a filter graph that never reaches EOF
spins at 100% CPU indefinitely. Two orphans from interrupted test runs were
found on a dev host having burned 15 h and 11 h of CPU, with no parent to
attribute them to.

PR_SET_PDEATHSIG has the kernel kill the child as the parent dies, so the
outcome stops depending on our cleanup running at all. Best effort, a no-op
where prctl is unavailable, and tested by SIGKILLing a real parent rather than
by asserting the flag is set.

Also bound the audio mix at 20x its own length with a two-minute floor. Mixing
a few seconds of PCM takes milliseconds, so the two-hour video backstop meant a
wedged mix sat for two hours; it now gives up in two minutes.

Plus a test that every name identifying a whisper.cpp runner reaches it -- the
runner's id, a shared alias, and the weights path /v1/models advertises, by
full path, basename and stem -- and that naming the weights spreads across a
shared alias instead of serialising a pool configured for capacity.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014T3rZnLhydX9QqUcfBbqLu