More robust process management

[pcrock-thmdo]

When the container receives a signal, we manually forward those signals to child processes with a bit of bash trap logic.

(Only SIGINT and SIGTERM... other signals are ignored)

This is a bit hacky, and really requires that we know what we're doing.

This change replaces that bash hackery with a proper 🧐 process supervisor, tini.

Full explanation in doc/process-management.md -- that's probably the best place to start looking at this PR.

testing

recommended that we do a full test with a couple of our containers in heroku before merging this. but to test locally:

in one terminal, build and start your container:

make python
docker run --rm -it \
  --env PORT=8080 \
  --env APP_PORT=8000 \
  --env SIGSCI_ACCESSKEYID=$SIGSCI_ACCESSKEYID \
  --env SIGSCI_SECRETACCESSKEY=$SIGSCI_SECRETACCESSKEY \
  localhost/thermondo-sigsci:python-3.12 \
  python3 -m http.server

in another terminal, attach to the running container and start sending signals to various processes to see what happens:

docker exec -it "$(docker container ls --latest --quiet)" /bin/bash

# install `ps`, `kill`, etc.
apt update && apt install --yes procps

# see what processes are running
ps -e

# send signals to those processes
kill 1

if you try to kill the bash process, nothing will happen. but if you kill python3, tini, or sigsci-agent, then the container should exit.

alternatively, instead of docker exec, you can try stopping the container:

docker stop "$(docker container ls --latest --quiet)" --time 999

if the above command stops the container immediately, then you know it works. if it stops only after 999 seconds, then there's a problem.