Yes, it's on Debian, and php session garbage collection is implemented via /etc/cron.d/php.
I did run <roundcube>/bin/gc.sh manually, I then entered
$config['temp_dir_ttl'] = '48h';
also tried rebooting the machine. At some point, I figured out that RCMTEMPthumb* apparently does get deleted (or did get deleted as a consequence of my attempts above). *.thumb doesn't get deleted (also didn't in my above efforts), but they apparently had stopped being created when I updated to 1.4.3. I've now manually deleted the *.thumb files and will see what happens.