Reclaim the jobs of a worker that died without unwinding (#150)

[r0ny123]

Closes #150 (a hard-killed worker strands its job forever, and the stranded job is then served to identical resubmissions).

Cause

A worker killed with SIGKILL (the OOM killer's way) never runs its context manager's exit, so its registration and the lock on the job it was running stay behind. next() only hands out unlocked jobs, and release_orphaned_jobs() only released jobs of unregistered workers, which a killed worker is not. So the job stayed locked for good, and get_cached_job_id() handed its id to every identical resubmission, which then waited on work that could never run.

Fix

Registration alone is not liveness, so workers now carry a heartbeat:

• registerWorker() records a heartbeat next to the registration; next() refreshes it off the poll loop, throttled to a third of the queue timeout (one write per 100 s at the default 300 s).
• A registered worker whose heartbeat is older than the timeout is dead. release_orphaned_jobs() releases the unfinished jobs of every worker that is not live, with one attempt fewer; a job out of attempts fails and notifies its dependents, like Job.error() does; the queue counters follow. Dead registrations are dropped, so the worker list stops accumulating ids of long-gone processes. It runs when a worker starts, as before, and from the poll loop once per timeout.
• get_cached_job_id() only serves a job that is finished, waiting, or in flight on a live worker.
• A registration without any heartbeat is a pre-heartbeat process that was not shut down cleanly and is treated as dead. locked_at is still not used for liveness, for the reason repair() documents (a healthy long job would look stale).

Known limit, unchanged from before: if the parent of a spawning worker is killed while its child still runs the job, the child may still complete it after the reclaim, so the job can run twice. The timeout bounds when that window opens.

Verification

• tests/testMongoQueue.py WorkerLivenessTest (7 tests): registration writes and removal of the heartbeat; liveness by heartbeat age, including the no-heartbeat case; a dead worker's job is reclaimed with one attempt fewer while a live worker's is kept and the dead registration pruned; a job never registered for; reclaiming the last attempt fails the job and frees its dependent, with the failed counter incremented; the cached-job lookup skips the stranded job, serves it again once reclaimed, and serves a finished one regardless; polling heartbeats only past the interval and reclaims past the timeout.
• Queue, worker-resilience and remote-call suites: 55 passed; ruff check, ruff format --check, ty check clean.
• Live, on the MongoDB-backed instance: five forced jobs queued, the worker kill -9'd while running one. The job was left with locked_by set, finished_at: None, attempts_left: 3 and the registration still present, exactly as the issue describes. A replacement worker started, processed the other queued jobs, and at 295 s (the dead heartbeat's age passing the 300 s timeout) released the stranded job, ran it and finished it with a result; the dead registration was gone from the worker list.

Note: this touches get_cached_job_id next to #160; the two merge cleanly (kept both conditions) and that combination is what the live instance ran for this verification.