fix(cloakserve): evict poll()-alive but CDP-dead browsers instead of serving 502s - #492

Problem

ChromePool.get_or_launch decides whether to reuse a pooled Chrome for a seed with a single liveness check — proc.process.poll() is None. But poll() only reports whether the OS process has been reaped, which lags CDP availability in two common ways:

• Graceful-shutdown window. Chrome tears down its DevTools/CDP listening socket seconds before the process actually exits. A client that closes a browser and immediately requests the same fingerprint seed is handed the still-"alive" process whose CDP port already refuses connections.
• Wedged browser. A hung/unresponsive Chrome can keep its process alive indefinitely while its CDP port no longer answers.

In both cases the dead process is returned, and handle_json_version / handle_json_list then fail to reach http://127.0.0.1:<port>/json/version and return 502 {"error": "CDP endpoint unreachable"}. Crucially, the 502 path does not evict the dead pool entry, so every retry for that seed hits the same corpse — the failure is not self-healing until the OS finally reaps the process (or the idle timeout fires).

This is easy to trigger under any workflow that reuses seeds across browser restarts, or when a browser crashes/OOMs and lingers mid-shutdown. Under load it presents as a burst of dead-port 502s against a seed whose process still poll()s as alive.

Fix

1. get_or_launch reuses a poll()-alive process only if its CDP port actually accepts a TCP connection (_cdp_port_alive, a sub-millisecond local connect). poll() short-circuits the check, so an already-exited process skips the probe and takes the existing cleanup+relaunch path. A poll-alive-but-dead-port corpse now falls through to _cleanup_process + a fresh launch, under the existing per-seed lock.
2. handle_json_version and handle_json_list wrap the fetch in a 2-attempt loop: on the first connection failure they evict the stale entry and retry once, so a browser that dies in the narrow window between the probe and the fetch becomes a single cold relaunch instead of a persistent 502. Eviction matches the pooled process by object identity, never by recomputing the seed key, so a concurrent relaunch on the same seed is never killed.

The reuse fast-path stays fast (one cheap local connect) and behavior is unchanged for a genuinely-live browser.

Tests

Added to tests/test_cloakserve.py:

• TestCdpPortAlive — the probe returns True for a listening port, False for a closed one.
• TestPoolKeyForIdentity — identity match; returns None when a concurrent relaunch has replaced the entry.
• TestGetOrLaunchReuseGuard — poll-alive-but-dead-port is evicted and relaunched; poll-alive-and-port-alive is reused after exactly one probe (no relaunch).
• TestHandlerCorpseRecovery — json/version and json/list recover without a 502 by evicting once and retrying; they return 502 only after both attempts fail; identity-based eviction spares a concurrently-relaunched process.

Two existing tests were adjusted for the new reuse probe. pytest tests/test_cloakserve.py → 113 passed.