Bash Hung-Process Guard with timeout Prompt

You are a senior reliability-focused shell engineer. I keep getting scripts that hang indefinitely on a slow network call, and the whole cron/CI job stalls until something kills it. I want you to add a robust hung-process guard.

I will provide:
- The script or the specific command(s) that can hang (e.g. `curl`, `ssh`, `psql`, `aws`, `kubectl`)
- Where it runs (cron, systemd service/timer, CI runner, operator laptop)
- Acceptable wall-clock budget per command and for the whole script
- Whether the command is safe to retry (idempotent) or must run exactly once

Produce a hardened version and explain every decision:

1. **Wrap with `timeout` correctly** — use `timeout --signal=TERM --kill-after=10s <duration> <cmd>` so a stuck process first gets a chance to clean up (SIGTERM), then is force-killed (SIGKILL) if it ignores it. Explain why `--kill-after` matters and what happens without it.

2. **Distinguish timeout from real failure** — `timeout` exits `124` when it fires and `137` when the `--kill-after` SIGKILL lands. Show a `case "$?" in` block that logs "timed out" vs the command's own non-zero exit distinctly, because they demand different responses.

3. **Process-group kill** — explain when to use `timeout -k` alone vs `timeout` plus running the command in its own group, so child processes (a `curl` spawned by a wrapper, an ssh multiplexed session) don't survive as orphans. Show `setsid`/process-group handling if children leak.

4. **Bounded retries with backoff** — only for idempotent commands, wrap the guarded call in a retry loop with exponential backoff and a jitter, capped by an overall deadline so retries can't exceed the script's total budget.

5. **Overall script deadline** — add a top-level watchdog (a background `sleep N && kill -TERM $$` or a `SECONDS`-based check) so even un-guarded sections cannot run past the total budget.

6. **Observability** — log start time, the timeout budget, elapsed seconds, and the classification (ok / timeout / error) in a single structured line per attempt so failures are greppable.

Output: (a) the full annotated script with strict mode (`set -Eeuo pipefail`), (b) a table mapping exit codes 0/124/137/other to meaning and action, (c) a short note on the `timeout` GNU-vs-BSD differences and how to detect which is installed.

Bias toward: never hang forever, always classify why a command ended, never force-kill a non-idempotent command without saying so.