chore: pin capped commands to one CPU core

scripts/with-memory-cap.sh

@@ -174,7 +174,7 @@ run_systemd() {
 	# expliciet: deze host heeft geen swap.
 	local high=$((effective * 95 / 100))
 	echo "[mem-cap] systemd cgroup MemoryHigh=$((high / 1024 / 1024))MB MemoryMax=$((effective / 1024 / 1024))MB MemorySwapMax=0: $*" >&2
-	exec "${systemd_cmd[@]}" -p "MemoryHigh=$high" -p "MemoryMax=$effective" -p "MemorySwapMax=0" "$@"
+	exec "${systemd_cmd[@]}" -p "MemoryHigh=$high" -p "MemoryMax=$effective" -p "MemorySwapMax=0" -p "CPUAffinity=0" "$@"
 }
 
 run_ulimit() {
@@ -186,7 +186,7 @@ run_ulimit() {
 		echo "[mem-cap] ulimit -v $virtual_kb werd geweigerd" >&2
 		return 1
 	}
-	exec "$@"
+	exec taskset -c 0 "$@"
 }
 
 run_refuse() {
@@ -197,7 +197,7 @@ run_refuse() {
 
 run_opted_out() {
 	echo "[mem-cap] WAARSCHUWING: plafond bewust uitgeschakeld, dit commando kan de machine laten OOM-killed worden: $*" >&2
-	exec "$@"
+	exec taskset -c 0 "$@"
 }
 
 case "$backend" in