Safer cleanup on SIGTERM

[lionel-]

This makes the SIGTERM handler safer because system() is not safe to call from a signal handler (see https://sourceware.org/bugzilla/show_bug.cgi?id=4737). To avoid doing too much work in the handler, we prepare a cleanup process ahead of time that we can trigger from the SIGTERM handler with an async-safe one-byte write.

I'm a bit uneasy about calling rm -rf on an envvar though. Should we use the previous approach of querying tempdir() to create an rm -rf command ahead of time?