Kill forked submission processes after execution

[Sakshamm-Goyal]

Summary

• run each submission in its own session/process group
• kill any descendants left behind after the direct submission process exits
• add a regression that forks a sleeping child, simulates a CPU-limit signal, and verifies the child does not survive

Closes #450

Validation

• fail-first regression: the forked child remained alive before the process-group cleanup
• .venv/bin/python -m pytest -q tests/test_run_program.py tests/test_run_limit.py — 2 passed
• .venv/bin/python -m pytest -q --ignore=tests/test_latex.py --ignore=tests/test_markdown.py --ignore=tests/test_xss.py — 67 passed
• .venv/bin/ruff check .
• .venv/bin/ruff format --check .
• .venv/bin/mypy --non-interactive --config-file mypy.ini -p problemtools

The full local pytest run additionally needs lualatex; without it, the first PDF-render test fails and leaves the process in a removed temporary working directory, which cascades into 10 unrelated render-test failures.