Loop robustness and supervision for the worker.

The loop cannot be killed by a single bad iteration. A failed receive arrives as the queue handle's typed fault value: the step logs it and backs off (its own fixed pacing over the typed channel). Residue -- an exception escaping a dependency's typed contract mid-iteration -- is the supervision combinator's concern (superviseLoop wraps the step under the caller-supplied policy), classified per that policy: transient residue is logged and retried with bounded exponential backoff, while a wiring fault the policy names Permanent fails up through the composition root's race and takes the process down (fail-stop). Each successful poll and each completed job advances the WorkerHeartbeat, so a stalled loop is visible to the liveness probe.

Shutdown tears the loop down cleanly: the composition root runs it raced against the server within its resource bracket, so process teardown cancels the loop thread (the combinator never catches cancellation) and an in-flight, un-acked message simply redelivers -- safe, because publishing is idempotent (a version already present is success).