fix(runtime): coordinate task cancellation lifecycle

[hongjr03]

Implements the T4 runtime lifecycle work from the architecture audit. This change adds shared cancellation tokens and request/server cancellation plumbing, keeps request, shutdown, formatter, and Qihe cancellation token/process-driven at the runtime boundary, maps explicit cancellations to RequestCancelled while preserving stale-analysis retry behavior, changes the task pool to weighted fairness, and contains panics at request/background progress boundaries. Formatter and Qihe external processes now use cancellable process helpers that manage stdin/stdout/stderr and kill process trees; Qihe runs also use run-scoped progress tokens and final commit guards so stale or cancelled runs cannot publish diagnostics. Semantic-token delta cache updates now run as accepted response effects on the main loop, while Salsa synthetic cancellation remains confined to DB change/reload boundaries. Validation: cargo fmt --all -- --check; cargo clippy --workspace --all-targets -- -D warnings; rustup run nightly cargo test --workspace; git diff --check.