Recycle gunicorn workers to bound memory growth

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anth-volk

gcp/cloud_run/start.sh

@@ -63,12 +63,18 @@ done
 # multi-minute app import (which happens in the worker, post-fork, because
 # --preload is NOT set). --timeout 0 is required: a worker mid-import does
 # not heartbeat, and the default 30s watchdog would kill it before boot.
+# --max-requests recycles workers to bound the slow memory growth seen in
+# the Stage 2 30-minute soak (69% of 16Gi at --concurrency 4; OOM SIGKILL
+# at 8); jitter staggers recycling — a recycled worker re-imports for ~3
+# minutes, halving instance capacity while it does.
 gunicorn policyengine_api.asgi:app \
   --worker-class uvicorn.workers.UvicornWorker \
   --workers "$WEB_CONCURRENCY" \
   --bind "0.0.0.0:${PORT}" \
   --timeout 0 \
   --keep-alive 5 \
+  --max-requests 500 \
+  --max-requests-jitter 100 \
   --forwarded-allow-ips '*' &
 server_pid="$!"