fix(worker): bound gevent warm shutdown

[suguanYang]

Summary

• Add a worker-owned bounded warm-shutdown controller for the gevent pool.
• Keep broker-reconnect cancellation as a no-op while using Celery's saved original gevent termination only for explicit SIGTERM shutdown.
• Continue canceling later active tasks when retry/result-backend bookkeeping fails.
• Add process-level contract coverage for active cancellation, early completion, repeated SIGTERM, reconnect isolation, backend failure, and the ECS child-cleanup budget.

Verification

• Worker bootstrap and shutdown contract suites: 12 passed.
• Ruff passed.
• Pyright passed with 0 errors and 0 warnings for the production changes.
• Git diff check passed.

Scope

This PR is limited to the worker shutdown behavior required by the Fargate interruption gate. It does not deploy, change AWS resources, or address unrelated code-quality work.

Related to #22