RSS-capped worker pools: floor the cap above post-open size

A worker pool that recycles a worker when its RSS exceeds a configured cap will storm (hundreds of restarts in seconds, requests never answered) if the cap is below a freshly started worker's own RSS after opening its input. Clamp the effective cap to (post-open RSS + headroom), warn once when raising it, and add per-slot backoff (e.g. 3 recycles in 10 s triggers waiting 1 s, 2 s and so on up to 60 s while still serving). Also retry a request refused by the memory bound once on the fresh replacement, so in-flight work isn't failed by the recycle itself.