fix: run Flask with Gunicorn gthread

[tappe9]

Summary

• replace Waitress with pinned Gunicorn 26.0.0 for the existing Python / Flask implementation
• run Gunicorn with one gthread request worker, one request thread, and HTTP keep-alive
• keep Flask handlers, the synchronous psycopg pool, the 1 CPU / 512 MiB container budget, and the existing benchmark endpoints unchanged
• create the PostgreSQL pool inside the Gunicorn worker and close it on worker exit
• validate the Gunicorn arbiter + exactly one request worker without weakening the one-process contract for other implementations
• preserve historical Waitress reports without introducing a new report schema: server packages remain recorded in provenance, while the registry requires only version fields common to both Flask server generations

Why

Issue #70 reproduced the extreme Flask/Waitress JSON slowdown. A predeclared non-publishing alternatives screen showed that changing the WSGI server to Gunicorn gthread avoided the anomaly without CPU-affinity policy or a framework rewrite. This is the smallest supported production change from that investigation.

TDD and evidence

• RED: temporary CI run 36287376476 failed because the acceptance contract required gunicorn==26.0.0 while main still pinned Waitress.
• Process-model tests require exactly one Gunicorn arbiter plus one request worker and reject an extra worker.
• GREEN: temporary acceptance run 36287677391 passed the Python / Flask real-container acceptance, including startup failure, HTTP behavior, resource/process checks and SIGTERM shutdown.
• Non-publishing confirmation run 36287747335 passed the same acceptance plus the shared HTTP contract and bounded load confirmation. Its diagnostic values are evidence only, not official results.
• The temporary workflow was removed before this PR.

Scope boundaries

No CPU-affinity change, framework rewrite, official benchmark dispatch, publication, cohort activation, release, tag, repository setting or permission change.

Closes #70.

[tappe9]

Post-merge verification — 2026-09-27

This continuation re-read GitHub state and found the PR already merged; no duplicate source change or merge was performed.

• Final PR head: 75b108fc475672554c249daeb29f25ea8d56e9dd. Its associated PR CI 36311032604 is completed/success.
• Current main / squash commit: eba127e65761ced4d0fef06a6c52cc2dc1fdb6ab (merged at 2026-09-27 10:08:57 UTC).
• Main push CI 36311604434: completed/success. All 13 job conclusions were re-read: plan, shared, smoke, all nine implementations, and required. The previously failing make test-site step is successful, as are the shared registry/database/benchmark gates and Flask acceptance/contract gates.
• Pages 36312085514: completed/success. Both reusable build and deployment jobs succeeded for this main SHA.
• The comparison with pre-change main 9b92c74cba34bd5a4bfc389075b9bef135131034 contains one commit and 15 modified files (+107 / -93). There are no changes to results/**, either README, Docker Compose, measurement-profile definitions, or workflow files. No permanent diagnostic module from test: investigate Flask JSON scheduling sensitivity without changing official results #76 was introduced.
• Investigate unexpectedly low Flask JSON throughput without changing official results #70 is closed/completed; test: investigate Flask JSON scheduling sensitivity without changing official results #76 is closed/unmerged. The current open-PR listing is empty.
• The repository's latest report still identifies the original September 15 measurement (c8e033ea176366644f5bed5ded12cab79e6fcbeb, run 34925168324, Waitress 3.0.2). It is not a Gunicorn result.

Verification limit: a direct check of publicly served Pages bytes could not be completed. The web fetch was inaccessible and this execution environment could not resolve either the Pages or raw-content host. This is an access limitation, not evidence of a site failure; the successful GitHub Pages deployment was verified separately. No live byte-parity claim is made.

No local test re-execution, source modification, new workflow invocation, official measurement/publication, or settings change was performed in this continuation. This records existing executed CI evidence, not an independent review approval.