feat: renew in-flight job timestamps via a worker heartbeat

[mattstrayer]

Closes #16.

Companion PR for the long-running-job double-execution issue. As described there, when a handler runs longer than stalledThreshold, nothing ever refreshes acquiredAt between claim and completion, so the stalled-recovery path re-delivers the job to a free slot and it runs a second time, concurrently. stalledThreshold effectively becomes a hard cap on how long a job may run rather than a crash-detection window.

What this does

Adds a heartbeat that periodically renews the acquired timestamp of the jobs a worker is actively processing.

• renewJobs(queue, jobIds) on the Adapter contract, implemented for every backend:
  • Redis — new RENEW_JOBS_SCRIPT Lua that HSETs acquiredAt on the active hash, preserving workerId.
  • Knex — UPDATE ... WHERE status = 'active' AND id IN (...).
  • Fake / Sync adapters (and the in-memory test mock).
  • Only entries still active are renewed, so a job that was already recovered or finalized is never resurrected by a late heartbeat.
• A dedicated worker setInterval (~stalledThreshold / 2) that renews the in-flight job ids. It has to be a separate timer rather than piggybacking on the process loop: at full concurrency the loop blocks on waitForNextCompletion() with no idle tick, so the loop is not cycling exactly when long jobs are in flight.
• The heartbeat is cleared in stop() (after draining, so jobs still finishing keep being renewed until they complete) as well as in the process() generator's finally, giving deterministic cleanup whether the worker is driven via start() or processCycle(). #startHeartbeat is idempotent so the timer can't leak if the loop is re-entered.

Net effect: "stalled" once again means the worker actually died, so stalledThreshold can stay small without re-delivering healthy long-running jobs.

Tests

• renewJobs behavior across all adapters via the shared driver suite: renewal keeps an active job from being recovered, never resurrects an already-recovered job, is queue-scoped, and is a no-op for an empty id list.
• Worker-level: a long-running job at full capacity is kept alive by the heartbeat and executes exactly once (verified against a negative control where the double-execution reproduces without renewal), and the heartbeat stops firing once the worker is stopped.

All 647 tests pass locally across Memory, Redis, Knex (SQLite) and Knex (PostgreSQL); tsc, oxlint and oxfmt are clean.