fix(worker): run introspect/build Ray tasks in a fresh process (max_calls=1)

[nilsmechtel]

Problem

Even after #144, a redeploy could keep running old code. The introspect and build Ray tasks import the user's deployment modules into their worker process, and Ray pools task workers. _load_app_class uses importlib.import_module, which returns a cached sys.modules entry (Python resolves imports from sys.modules before sys.path). So a worker that built an earlier version keeps that version's classes cached:

• introspect_app captures the stale class in the spec;
• build_and_run_application binds the stale class — and because the @bioengine.app class carries closure methods (wrap_init / check_health / bioengine_runtime_version), cloudpickle serialises it by value to the replicas.

The replicas therefore run the stale class even though app_dir/source and the content-addressed app_source_uri package on disk are the correct new version. This is upstream of #144's source-materialisation fixes (sys.path insertion is bypassed by sys.modules), and can make running code older than files on disk.

Solution

• Add max_calls=1 to the introspect and build ray.remote tasks so each runs in a fresh process — empty sys.modules, so the import reads the refreshed source, and runtime_env env_vars are applied fresh.
• Switch the per-build env application in bootstrap.py from os.environ.setdefault to direct assignment, so a build's BIOENGINE_ARTIFACT_VERSION / BIOENGINE_APP_SOURCE_URI always win (a reused worker would otherwise keep a prior build's values).

Behavioural changes

Each deploy spawns a fresh short-lived Ray worker for its introspect and build tasks (content-addressed runtime_env packages are already cached, so no re-upload/reinstall). No API changes.

Test plan

• No-regression on the fix(worker): guarantee & verify running code matches requested version on redeploy #144 validation suite (single-deployment version bump, cross-artifact same-version, and a 3-deployment composition via stop_app → fresh deploy_app) on a dev image in single-machine mode.
• Confirm each deploy's introspect/build runs in a distinct worker process.

Files

• bioengine/apps/builder.py — max_calls=1 on both Ray tasks.
• bioengine/_app/bootstrap.py — per-build env applied with overwrite semantics.