fix: hand work back properly, and let go of what is gone

[thedancingdeveloper]

Closes #126. Closes #104. Closes #107.

#126 — retry was a no-op on the state most likely to prompt it

POST /api/work/{id}/retry called release(item_id, PENDING, error=None).
Two consequences neither intended nor visible:

• attempts untouched, so an item at max_attempts was retired again by the
  next claim scan before any worker saw it. Observed live: exhausted → pending → exhausted in seconds, with nothing having run.
• error=None wiped last_error — the only record of why it failed, and what
  the retirement message appends to itself. So the retry downgraded a
  diagnosable failure to gave up after N attempts with no cause.

WorkQueue.requeue resets the counter and keeps the error.

#104 — a claim held by a process that no longer exists

The lease is slow on purpose: a slow worker must not be evicted. But a worker
killed with its lease running leaves an item claimed by a pid that is gone,
unavailable to healthy workers, while new items dispatch around it.

reclaim_dead_workers runs at pool start and releases those claims. Bounded
carefully:

• only claims owned by this host — a pid elsewhere says nothing;
• os.kill(pid, 0), where PermissionError counts as alive;
• any unexpected OSError is treated as alive, because releasing a live
  worker's item is far worse than waiting out a lease.

Tests cover the dead pid, a live pid, and another host.

#107 — a corrected graph did not stop work already in flight

claim checks dependencies once. Correcting a plan while an item is running
is a normal operator action, and the item went on through review, commit and
push on the strength of a check made minutes earlier.

unmet_dependencies is now re-checked at the last cheap point before the
reviewer is paid, and an invalidated item is emitted as
dependency_invalidated and returned to pending with its branch intact. No
agent is killed mid-item, per the standing rule.

Suite, ruff and mypy . green.