These timeouts make it possible to abort processing instead of having
to wait until it finishes (as is the case with a Knative timeout).

Optional is deprecated, and typing.Tuple can be replaced with tuple.

This interrupt can be used to indicate that the app should clean up,
then shut down.

This spec is already assumed by the pipeline, and without explicit
documentation it's not obvious why no current branch raises
RetriableError.

Factoring out the check makes it easier to handle different exceptions
slightly differently.

If pipeline processing is interrupted (the most likely case),
retriability is handled with almost the same logic as pipeline errors
(the exception is that an interrupt is our first nondeterministic
failure mode). Otherwise, the failure is assumed non-retriable just
in case.

This makes it possible to adjust the grace period to accommodate the
service's long shutdown time (in particular, syncing to the
central repo).

This handler lets us retry services that were shut down during
prep_butler or while waiting for raws. The outermost handler is still
needed to catch interrupts that slip through the cracks.