move the post mortem code out to its own file

it will grow some later when the syscallrecord dumping is added,
and watchdog.c is getting a little cluttered
close small race between reading fd and other related args
syscallrec -> rec, as elsewhere
remove old debug code

this issue got fixed when locking was added to the syscallrecord