Make __kill_work itself also be a completion timeout.
Forcibly kill everything silently with an exit code of 1 should we fail to cleanly shut down and use a completion timeout for the __kill_work in app_restart.