fn start_parent_watcher(parent_pid: u32)
Event-driven parent process watcher using pidfd_open (Linux 5.3+). Falls back to PPID polling on older kernels without pidfd support.