Take the engine off the path node code imports from, and let it stop

The worker script is handed to the interpreter by path, so app/flow was
sys.path[0] for every node: `import queue` got the engine's. It now drops
its own directory before anything else imports, and runs with the
deployment's credentials scrubbed out of its environment.

Also: reload builds off the event loop, the pool wakes what is blocked on
it when it stops, a refused metrics flush is kept for the next one rather
than dropped, and the cascade events are paired through failures.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017MeiWk3Yq12n2pTvnQWYvt

backend/app/api/routes/observability.py

@@ -123,11 +123,13 @@ async def read_summary(
     if errored:
         problems.append(f"{len(errored)} node(s) failed to load")
 
-    failures = session.exec(
+    statement = (
         select(func.count())
         .select_from(EngineEvent)
         .where(col(EngineEvent.ts) >= _since(24), col(EngineEvent.type) != "audit")
-    ).one()
+    )
+    # The health page polls this every ten seconds; the driver is synchronous.
+    failures = await run_in_threadpool(lambda: session.exec(statement).one())
 
     return HealthSummary(
         status="degraded" if problems else "ok",