HH-442: isolate runtime processes and harden shutdown (#90)

* HH-442: isolate runtime processes and harden shutdown

* HH-442: harden worker shutdown races

* HH-442: gate dependency shutdown on active handlers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

.github/workflows/ci.yml

@@ -31,6 +31,8 @@ jobs:
         id: chrome
       - name: Install browser harness
         run: python -m pip install browser-harness==0.1.9
+      - name: Test Prometheus alert rules
+        run: docker run --rm --entrypoint promtool -v "$PWD/backend/configs:/configs:ro" prom/prometheus:v3.5.0@sha256:63805ebb8d2b3920190daf1cb14a60871b16fd38bed42b857a3182bc621f4996 test rules /configs/prometheus_alerts_test.yml
       - name: Test
         working-directory: backend
         env:
@@ -207,7 +209,7 @@ jobs:
           docker compose -f deploy/docker/docker-compose.prod.yml config --format json | python3 -c 'import json, os, sys; config = json.load(sys.stdin); assert all(config["services"][service]["environment"]["GOCHAT_JWT_PREVIOUS_SECRETS"] == os.environ["GOCHAT_JWT_PREVIOUS_SECRETS"] for service in ("gochat", "worker"))'
           docker compose -f deploy/docker/docker-compose.prod.yml --profile ops run --rm migrate
           docker compose -f deploy/docker/docker-compose.prod.yml up -d --wait gochat
-          curl -fsS "http://127.0.0.1:$GOCHAT_PORT/health" | grep -q '"status":"ok"'
+          curl -fsS "http://127.0.0.1:$GOCHAT_PORT/health" | grep -q '"status":"healthy"'
           curl -fsS "http://127.0.0.1:$GOCHAT_PORT/app" | grep -q '/assets/'
       - name: Stop production Compose
         if: always()