Stop pending actor startup before shutdown

[cevr]

Stopping an actor during recovery could return before startup ended. Recovery could then create background work after the actor became terminal. Stop also lost errors from recovery cleanup.

Give startup a child fiber and shutdown one shared owner. Shutdown cancels startup, waits for its cleanup, and then closes the runtime. Each external stop caller can cancel its own wait. Owner creation and cache publication finish before caller cancellation can take effect. Self-stop marks the startup fiber interrupted, so recovery fallbacks cannot swallow the stop. Protected recovery regions finish before shutdown completes.

1. Startup and shutdown ownership:

 actor.stop
-  close current runtime
-  delayed recovery can resume startup
+  request one shutdown owner
+    interrupt and await pending startup
+    stop supervisor and runtime
+    publish terminal result and cleanup errors
+  external caller joins owner
+  startup self-caller marks itself interrupted

2. Startup completion:

 actor.start
+  register cancellable startup child
   recover → initialize → start event loop
-  publish Active after checking exit
+  make event loop ready for synchronous sends
+  publish Active only from same-generation Starting

A patch changeset records the fix. The full gate passes type checks, lint, formatting, build, examples, and 379 tests with 828 assertions. Regression tests cover delayed recovery, cause fallbacks, external waiters, protected self-stop, and cleanup errors. Existing synchronous send and Atom behavior tests pass. The state stream test now waits for the initial value and each transition explicitly.

Two Counsel rounds are complete. The final finding has a failing regression on the prior candidate and passes after the repair. The full gate passed again after that repair.