feat(archon): rebuild-class config supervisors for scanner and feeds (#529 step 6)

[forkwright]

Step 6 of the #529 reactive-config migration — the two rebuild-class subsystems (library scanner and feed scheduler) now reconfigure live on a config reload instead of only at startup.

Both follow the supervisor pattern established in steps 4-5: a spawned archon task owns the subsystem from boot, watches its config section via SectionWatcher, and on a change tears the old instance down and rebuilds it from the new config.

• run_scanner_supervisor watches taxis.*. On change: ScannerManager::shutdown().await (joins all scan tasks) → ScannerManager::start(&new_taxis, event_tx). kathodos is safe to rebuild wholesale (no statics; fresh channels/semaphore per start). In-flight scans abort via kathodos's existing shutdown-yield and re-run on the next interval of the new instance.
• run_feed_supervisor watches komide.*. On change: FeedScheduler::shutdown() → start_feed_scheduler (rebuilds the bounded reqwest client, a new FeedSchedulerService — which owns its own KomideConfig, so the scheduler alone isn't enough — and FeedScheduler::start).
• Both go through a shared rebuild_with_rollback state machine: on a rebuild start failure it attempts a rollback to the previous config; if that also fails the subsystem stays down with a loud error! and the server keeps serving (never panics). The helper is unit-tested directly with injected closures.
• Cancellation-token creation moved earlier in run_serve; each supervisor is spawned with a shutdown_token.child_token() and performs its own final teardown when the token cancels. run_serve's cleanup now .awaits the two supervisor JoinHandles (feed then scanner, preserving prior order) instead of calling .shutdown() directly.

A NOTE on the feeds path records that a rebuild re-pages feed rows from the DB (so a feed subscribed since boot gets a poll loop after a rebuild) — this is a side effect, not the fix for the runtime-subscribe defect (#577), which stays open.

Small introspection accessors added for tests: ScannerManager::scan_concurrency(), FeedScheduler::task_count().

Tests (real ConfigManager/Section) prove the watch→rebuild→shutdown loop runs end-to-end and that the rebuilt instance reflects the new config (via trigger_scan / DB re-paging), with no timing dependency. (Two initial start_paused designs were flaky — sqlx PoolTimedOut under paused time, and a notify watcher defeating the auto-advance — so they were redesigned around robust non-timing patterns.)

Gate: kanon gate --full green — fmt, check, clippy (-D warnings), nextest 416 (archon+kathodos+komide) / full workspace, deny, kanon lint (0/0). Gate-Passed stamped.

Refs #529