fix(process): recover from broken process pool

[olivermeyer]

Fixes #94.

Why?
When a subprocess dies abruptly (via os._exit(), a signal, OOM, or an exception that can't be pickled back to the parent), concurrent.futures marks the pool as broken and raises BrokenProcessPool on every subsequent submit() call. This exception escaped ProcessExecutor.push() into the worker's job-pull loop, killing the entire worker — triggering crash-restart loops under a supervisor and unbounded max_attempts inflation via the Recovery plugin.

How?
Pool construction is extracted into a _create_pool() helper. In push(), the pool.submit() call is wrapped in a try/except BrokenProcessPool: on failure the broken pool is replaced with a fresh one (old.shutdown(wait=False)), and the submit is retried once. If the retry also raises, the job is routed through on_job_completed(exc=...) inline so it fails/retries per its own max_attempts without BrokenProcessPool ever reaching the worker loop. A defensive pids_for_job.pop() is added to _on_job_completed to clean up entries left by processes that died before their finally block ran.

[olivermeyer]

Hi @TkTech any chance you take a look at this?