Add stage-2 decomposition benchmark; fix run_with_timeout latency and enforceability

bin/bench.jl reports stage 2 as a single throughput number, which can't
distinguish slow extraction from a slow spawn — and those have opposite fixes.
bin/bench_stage2.jl times each component in isolation, then times the real
handle_known_job end to end. It draws its corpus from real files (default
data/done) because random bytes make exiftool bail out early and understate the
stage by ~10x, and it prices both fork-free alternatives (batched, -stay_open)
so the cost of one-fork-per-file is a measurement rather than a guess.

The benchmark found stage 2 to be ~98% exiftool, and found two problems in
run_with_timeout, which stages 2 and 4 share:

1. The watchdog polled with sleep(0.1) and then joined the polling task, so
   every call paid the remainder of an in-flight sleep after the child had
   already exited: ~25 ms per file, and a measured 101 ms on a process that
   exits instantly. Replaced with a one-shot Timer cancelled when the child
   exits. Stage 2 goes from 164.6 ms to 138.3 ms per file (6 -> 8 files/s on one
   worker); the wrapper is now within noise of a bare Base.run.

2. Writing the missing tests showed the timeout was never enforceable, in the
   old implementation as much as the new. wait(proc) returns only once the
   captured stdout pipe closes, and grandchildren inherit that pipe, so
   signalling the child alone left the worker blocked until the whole process
   tree finished on its own — a `sh -c "trap '' TERM; sleep 30"` child ran the
   full 30 s against a 1 s timeout. The child now runs in its own process group
   and the timeout signals the group. The trade is that a hard crash of the
   server orphans an in-flight child rather than taking it down with it.

Three new tests cover the fast path, the timeout, and the SIGTERM-ignoring
escalation; the second was previously unexercised, which is why the bug stood.

Not addressed here, but measured and documented in the README: Perl interpreter
startup is 76.7 ms of the remaining 135.9 ms call, so a persistent exiftool
(-stay_open, 40.1 ms/file) would cut the stage by roughly another 70%. And
fsync_dir measures 1.75 us, too fast to be a real flush — commit_enriched!'s
durability may not hold on this filesystem, which is a correctness question
left open.

Claude-Session: https://claude.ai/code/session_01Xy9At7HNLHWNmfh1yw71Uy

test/runtests.jl

@@ -289,6 +289,42 @@ end
         end
     end
 
+    @testset "run_with_timeout: returns as soon as the child exits" begin
+        # Regression guard. The original implementation polled with sleep(0.1)
+        # and joined the polling task, so every call paid the remainder of an
+        # in-flight sleep after the child had already exited — ~101 ms on a
+        # process that exits instantly, on the hot path of stages 2 and 4. The
+        # bound here is deliberately loose (a loaded CI box is slow) but far
+        # under the 100 ms floor the polling version could not beat.
+        FileServer.run_with_timeout(`true`, 30)                       # warm up / compile
+        t0 = time()
+        out = FileServer.run_with_timeout(`echo hi`, 30)
+        elapsed = time() - t0
+        @test out !== nothing
+        @test strip(String(out)) == "hi"
+        @test elapsed < 0.05
+    end
+
+    @testset "run_with_timeout: kills an overrunning child and reports failure" begin
+        t0 = time()
+        out = FileServer.run_with_timeout(`sleep 30`, 1)
+        elapsed = time() - t0
+        @test out === nothing            # timed out → no output, caller degrades
+        @test elapsed < 5                # killed near the timeout, not after 30 s
+    end
+
+    @testset "run_with_timeout: escalates to SIGKILL when SIGTERM is ignored" begin
+        # A child that traps SIGTERM. Without the escalation the worker would
+        # block on wait(proc) forever and the timeout would be unenforceable.
+        cmd = `sh -c "trap '' TERM; sleep 30"`
+        t0 = time()
+        out = FileServer.run_with_timeout(cmd, 1)
+        elapsed = time() - t0
+        @test out === nothing
+        # 1 s timeout + up to KILL_GRACE_SECONDS before SIGKILL lands.
+        @test elapsed < 1 + FileServer.KILL_GRACE_SECONDS + 3
+    end
+
     @testset "run_exiftool: real extraction on a PNG" begin
         mktempdir() do root
             p = joinpath(root, "pixel.png")