Module worker 

Pub/Sub worker implementation for pulling and processing messages.

One pull-loop worker per subscription. Key properties: permit-before-pull (a pulled message’s lease isn’t ticking while it waits locally for a permit), a single 600s ack deadline extended up front and the handler bounded to it (no renewal loop; the extension is retried and, if it can’t be secured, the message is released rather than run under a too-short lease), re-enqueue-to-Redis on retry (including panics and timeouts, so bounded queues honor max_retries), drop on bounded exhaustion, and never ack incomplete work.