cgroup-memory.ts live hierarchy discovery

Trap: caching cgroup discovery, choosing the first matching mount, or using min(os.freemem(), process.constrainedMemory()) looks cgroup-aware, but memberships and mounts change, multiple roots may match, and constrainedMemory() is a limit—not headroom. Fix: re-read /proc/self/cgroup and mountinfo every call, safely decode and reject non-absolute/NUL/.. paths, select a mount whose root contains the membership, prefer explicit v1 memory on hybrid hosts, and take minimum limit-minus-usage through every readable descendant boundary. Never fall back to v2 when explicit v1 is unresolved; unknown or mid-call-changing state fails closed.