feat: cgroup constraints

[doc-han]

Short Description

uses cgroups to set resource limits on run processes so we can kill them before they take the worker down.

• The worker gets notified of the OOM kill by the cgroup constraint
• we have an identifier to determine whether the OOM was by cgroup or node heap limitation.

Fixes #

Implementation Details

A more detailed breakdown of the changes, including motivations (if not provided in the issue).

QA Notes

List any considerations/cases/advice for testing/QA here.

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

Release branch checklist

Delete this section if this is not a release PR.

If this IS a release branch:

• Run pnpm changeset version from root to bump versions
• Run pnpm install
• Commit the new version numbers
• Run pnpm changeset tag to generate tags
• Push tags git push --tags

Tags may need updating if commits come in after the tags are first generated.