fix(pipeline): let cancellation reach the processes it is meant to stop

[thcp]

Fixes #519. Independent; branches off 0.16.1.

1. Two ffmpeg calls were unregistered, so cancel could not reach them

runner.py:79 and :130 used subprocess.run(), which cannot be interrupted -- POST /cancel sets the flag but nothing looks at it until the call returns.

Cancelling during "Preparing audio..." on a 400 MB .mp4 was a no-op for up to TIMEOUT_FFMPEG per call, and that path runs both the video extract and the transcode.

Both now go through _run_registered_ffmpeg, mirroring collect._run_ffmpeg which registers for exactly this reason. It deregisters in a finally, so a failure cannot leave a stale entry a later cancel would terminate on the wrong job.

2. Two of three workers never armed the parent-death watchdog

STEMDECK_PARENT_PID was set in exactly one place (separate.py) and read in exactly one place (demucs_worker.py).

• A Force-Quit during a vocal split orphaned an onnxruntime process holding the GPU, with nobody to collect the result.
• A section pass outlived the parent whose TIMEOUT_SECTIONS was its only bound.

The watchdog moves to app/core/process.py -- where process_exists already lived specifically for it -- so all three workers share one implementation rather than three copies. All three spawn sites export the pid.

Poll interval preserved at 1.0s. I initially wrote 5s in the shared version, which would have silently slowed the existing demucs watchdog. Caught before commit.

3. A running vocal split was uncancellable by construction

cancel_job returns early for a done job -- and a vocal split only ever runs on a done job, so cancel_requested was never even set, while the split held _pipeline_lock and stalled the whole import queue for its duration.

Cancel now terminates the worker for that specific case. The split's own error path marks it failed and releases the lock, so nothing else was needed.

Verification

New tests/test_cancellation_reach.py, 12 tests. Confirmed not vacuous -- reverting the vocal-split cancel and one parent-pid export fails 2.

Two of them are deliberately structural (test_every_worker_spawn_exports_the_parent_pid, test_every_worker_arms_the_watchdog): they assert across all three workers, so a fourth worker added later without the watchdog fails the suite rather than silently orphaning a process.

ruff check       All checks passed
ruff format      94 files already formatted
pytest tests/    905 passed, 2 failed (pre-existing ogg pair)

Two existing test files updated, not fixed

• test_worker_parent_watchdog.py targeted demucs_worker._arm_parent_watchdog and demucs_worker.threading; both moved to app.core.process.
• test_video_status.py stubbed runner_mod.subprocess.run, which the extract no longer calls; it now stubs _run_registered_ffmpeg.

Behaviour is unchanged in both cases -- worth a look to confirm you agree the seams moved sensibly.