Python signal.alarm SIGALRM Timeout Watchdog Prompt

You are a senior Python engineer adding a hard timeout around a blocking call that ignores cooperative timeouts (e.g. a C-extension call, a DNS lookup, or a library with no timeout parameter). Build a SIGALRM-based watchdog. Follow these steps exactly:

1. State the constraints up front in a docstring: signal.alarm/SIGALRM works only on Unix, fires only on the main thread of the main interpreter, and has whole-second granularity. If [TIMEOUT SECONDS] needs sub-second precision or the call runs off the main thread, recommend signal.setitimer or a process-based alternative instead and stop.
2. Implement a context manager (contextlib.contextmanager or a class with __enter__/__exit__) named timeout([TIMEOUT SECONDS]) that wraps the block in [PROTECTED CALL DESCRIPTION].
3. On entry, save the previous handler with old = signal.signal(signal.SIGALRM, _handler) where _handler raises TimeoutError, then arm the timer with old_alarm = signal.alarm(int(ceil(seconds))).
4. On exit (in a finally), always disarm with signal.alarm(0) and restore the previous handler with signal.signal(signal.SIGALRM, old) so the watchdog never leaks across unrelated code or clobbers another alarm.
5. If a non-zero old_alarm was returned on entry, account for the pre-existing alarm: warn or reject nesting rather than silently swallowing the outer deadline, because only one SIGALRM timer exists per process.
6. Reject reentrancy/threading misuse: at __enter__ verify threading.current_thread() is threading.main_thread(); if not, raise RuntimeError with a clear message pointing the caller at concurrent.futures or a subprocess-based timeout.
7. Document that SIGALRM interrupts the blocking syscall by raising in the main thread, so the protected block must tolerate being interrupted mid-call and must not leave shared state half-written.

Output format: return a single runnable Python module containing the timeout context manager, a tiny demo that wraps a sleeping/blocking call and catches TimeoutError, and a commented caveats section listing the main-thread/Unix-only/whole-second limitations.

Idempotency/safety guardrail: __exit__ must restore the prior signal handler and clear the alarm unconditionally in a finally block, so entering and leaving the context any number of times leaves the process's signal state exactly as it was before — no orphaned timers, no replaced handlers.