You've already been given better solutions for your task, but it's still interesting to understand why your approach didn't work... so

2. Why does process 29309 still show when I have killed it in my code?

You're using a negative signal (intentionally or not), which means you're sending the signal to a process group (29309 in your case). This is generally a reasonable approach here (because it would have the cat process be signaled as well, which would otherwise remain running, if you kill the shell only). It didn't work, however, as a process group with that ID didn't exist.

When doing a ps (with customized output options (Linux syntax)) while all processes were still running, you'd have gotten something like:

$ ps axf -o pid,ppid,pgrp,cmd
  PID  PPID  PGRP CMD
...
29307  4061 29307      \_ /usr/bin/perl ./661639.pl
29309 29307 29307          \_ sh -c cat /dev/urandom > testfile
29310 29309 29307              \_ cat /dev/urandom
[download]

which shows that the process group is not 29309, but rather 29307, because the shell in this case doesn't create a new process group.

In other words, one of the following would have worked (note that you don't need signal 9 here, 15 (SIGTERM) is absolutely sufficient):

kill -15 => getpgrp($pid);  # process group of child
kill -15 => getpgrp;        # process group of current process (the sc
+ript)

# or even (as $$ equals the process group in this case):
kill -15 => $$;
[download]

( A problem could be (depending on context) that the script does get killed, too... but I won't try to come up with a workaround for that, because it's moot by now, anyway. )