Freeze-guard engine: watch memory pressure and proactively freeze/soft-cap
the non-protected app driving the pressure before the system locks up, healing
itself once pressure clears. Pure engine + sampler live here; the daemon loop
lives in the rlm-guard binary.
Shared tracing setup for the CLI, GUI, and guard daemon: logs go to
stderr (so stdout stays script-clean), colored only when stderr is a
terminal, filtered by RUST_LOG when set, else by a per-binary default.