Summary

Phase 12 work item. The current SIGTERM-only force-stop is a /* SHORTCUT */
in three places in src/main.c. A compositor or greeter that ignores SIGTERM
will leave the seat stuck forever — the daemon sends SIGTERM, never gets
SIGCHLD, and never restarts the greeter.

Background

Three call sites in main.c currently send only SIGTERM and rely on the
process exiting promptly:

• on_seat_removed — seat hotunplugged while greeter running
• on_can_graphical_changed — GPU removed from seat while greeter running
• on_drm_change — display disconnected while greeter running

All three have identical /* SHORTCUT: no SIGTERM→SIGKILL escalation (Phase 12) */
comments.

Proposed design

Use a timerfd per seat to implement escalation:

1. Send SIGTERM and arm a per-seat timerfd (e.g. 5 s timeout).
2. Register the timerfd with the event loop.
3. When the timerfd fires: if the process is still alive (seat still in
   SEAT_STOPPING), send SIGKILL.
4. When SIGCHLD arrives: cancel and close the timerfd.

The timerfd approach fits naturally into the existing poll-based event loop
(event_add / event_remove) and avoids blocking the daemon.

Related

• Depends on #2 (introduce SEAT_STOPPING state) — the escalation timer
  should only fire if the seat is still in SEAT_STOPPING.
• The session_shutdown path in session.c already implements SIGTERM→SIGKILL
  escalation using a blocking poll() loop. That shortcut should also be
  replaced as part of this work.