Settle cancelled stdio MCP services

[SaladDay]

Turn cancellation could report settlement after a local MCP interrupt or process leader exit while the MCP service's descendants continued running. Add the Runtime–Harness StopMCP contract so cancellation captures affected stdio services, drains native work, stops those services and their descendants, and waits for each old Process scope's ScopeClosed before reusable settlement. Other services and the workspace remain available. Stdio MCP admission now requires declared delegated cgroup v2 support; unsupported hosts fail with a typed error.

All three adapters retain current-Turn call ownership through local failures and cancellation races, then invalidate or reconnect only the selected native clients. Codex uses its existing persisted root_turn_id to include child calls that finish between observations. Its pinned native source receives a small explicit client-invalidation operation, built through the upstream build helpers with source, patch and artifact provenance; the previous precompiled-package path is replaced. Mcode preserves genuine SDK-response provenance without changing native error results. Protocol documentation and the coverage ledger are updated in English and Chinese.

Validation:

• Focused Go packages, go vet, cross-platform builds, formatting, names, translations and CI selection checks passed.
• Controlled Process-wire tests hold ScopeClosed after cancellation and leader exit; changed cancellation and ownership cases passed race ×50.
• Claude adapter: 180 TypeScript tests passed, with six affected cases repeated ×50. Mcode: the actual pinned service, pool, SDK and tool wrapper passed controlled lifecycle and timeout/error-provenance tests.
• Distribution artifact tests: 30 passed. Exact Codex patch applicability and native source identity checks passed.
• All three native artifact builds passed and their recorded inputs match this checkout. Codex targeted native tests (3), stripped static ELF checks, initialize capability, runtime staging and the upstream V8 stdio test passed. Public live acceptance remains pending on the final integrated distribution.

Known limits: Claude's native error frames cannot distinguish local failures from genuine server isError replies, so failed stdio calls remain cancellation targets within their current Turn. Codex cannot reliably attribute a previously active child Turn steered by another root when the observer first sees it after settlement; that narrow case remains unqualified in the coverage ledger.

All 24 CI checks passed for 2e0805b8. Fresh independent review findings were resolved with focused follow-up validation; the documented narrow Codex attribution limit remains deferred.