v0.9.26 — verified docker stop (swap race fix)

Fixed — the managed-server swap raced the old container's removal (#100).

Found by a user on the first real-world swap: docker stop's 20-second grace can be outlasted by vLLM's connection drain, after which the daemon SIGKILLs the container — and because it runs with --rm, its removal was still in flight when the replacement launched, dying on "container name already in use". The #99 fail-fast surfaced the crash quickly, and localharness start recovered cleanly once the name freed (the designed autostart path), so the failure was loud and recoverable — but the swap itself was broken under load.

Docker-mode stop is now a verified stop: drain grace raised to 60s, then the daemon is polled until the container name is actually free, docker rm -f fires as a fallback, and if the name never frees the stop raises explicitly instead of letting a relaunch race into the conflict. The swap also runs the stop off the event loop, so the session stays responsive through a slow drain.

Verified live after the fix with a full round trip through the real REPL — 35B → 27B (~8 min load) → 35B (~5.5 min) — zero name conflicts across both verified stops.

Tests: 3 new red→green (poll-until-free, force-remove fallback, fail-explicit); full suite 2309 passed / 0 failed.