fix: prevent SIGSEGV on shutdown in plugins and demo nodes

[bburda]

Summary

• Add shutdown_requested_ atomic flag, explicit destructors, and callback guards to 4 gateway plugins (ParameterBeacon, TopicBeacon, GraphProvider, SovdServiceInterface)
• Fix initial_check_timer_ self-cancel race and timer recreation race in lidar_sensor demo node
• Serialize concurrent create_generic_subscription() in SnapshotCapture (TSAN-confirmed data race)
• Enable ASAN/TSAN for integration tests in CI (caught the SnapshotCapture race)
• Add bugprone-* and cppcoreguidelines-special-member-functions clang-tidy checks
• Defense-in-depth hardening across demo nodes and test teardown
• Add post-shutdown unit tests for all 4 hardened plugins

---

Issue

• closes [BUG] Flaky test_beacon_param: gateway SIGSEGV on shutdown #359

---

Type

• Bug fix
• New feature or tests
• Breaking change
• Documentation only

---

Testing

• Full unit test suite passes (2446+ tests, 0 errors, 0 failures)
• 4 new post-shutdown unit tests verify callback guards work correctly
• ASAN (integration tests): PASS - no use-after-free
• TSAN (integration tests): PASS - no data races (after SnapshotCapture fix)
• All 12 CI jobs green: Jazzy, Humble, Rolling, Pixi (both), ASAN, TSAN, clang-tidy, coverage, format-lint, docs
• Local integration tests: 10/10 runs stable (zero flakiness)

Root causes found:

1. Shutdown race (issue [BUG] Flaky test_beacon_param: gateway SIGSEGV on shutdown #359): On Humble, timer->cancel() is non-blocking and does not drain the executor ready list. Callbacks already queued can fire after cancel returns, dereferencing partially-destroyed plugin state during gateway shutdown.

2. SnapshotCapture data race (TSAN): Concurrent handle_report_fault calls spawn capture threads that both call node_->create_generic_subscription() without synchronization. rcutils_hash_map (rclcpp internal) is not thread-safe for concurrent entity creation - corrupts node state, can cause SIGSEGV.

Scope: Systematic codebase audit found shutdown race patterns in 4 plugins and 2 demo nodes beyond the 2 files reported in the issue. All gateway managers already followed the correct pattern. Enabling TSAN for integration tests revealed the SnapshotCapture race that unit tests never exercised.

---

Checklist

• Breaking changes are clearly described (and announced in docs / changelog if needed)
• Tests were added or updated if needed
• Docs were updated if behavior or public API changed

[Copilot]

Pull request overview

Hardens shutdown/teardown behavior across gateway plugins and demo nodes to prevent timing-dependent use-after-free crashes (SIGSEGV), especially during CI/integration-test teardown on Humble where cancel/reset does not necessarily drain queued callbacks.

Changes:

• Add shutdown_requested_ guards + explicit destructors/shutdown idempotency in multiple plugins to prevent late callbacks from touching partially torn-down state.
• Fix demo node timer/shutdown races by adding mutex-guarded checks and explicit timer cancellation before recreation.
• Add additional teardown safety in a gateway SSE handler unit test and in fault-manager rosbag capture timer cleanup.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/ros2_medkit_plugins/ros2_medkit_sovd_service_interface/src/sovd_service_interface.hpp	Adds atomic shutdown flag and destructor declaration for service-interface plugin.
src/ros2_medkit_plugins/ros2_medkit_sovd_service_interface/src/sovd_service_interface.cpp	Makes shutdown idempotent and guards service callbacks during shutdown.
src/ros2_medkit_plugins/ros2_medkit_graph_provider/include/ros2_medkit_graph_provider/graph_provider_plugin.hpp	Adds shutdown flag and explicit destructor/shutdown override.
src/ros2_medkit_plugins/ros2_medkit_graph_provider/src/graph_provider_plugin.cpp	Resets diagnostics subscription on shutdown and guards diagnostics callback.
src/ros2_medkit_discovery_plugins/ros2_medkit_topic_beacon/include/ros2_medkit_topic_beacon/topic_beacon_plugin.hpp	Adds shutdown flag and destructor declaration.
src/ros2_medkit_discovery_plugins/ros2_medkit_topic_beacon/src/topic_beacon_plugin.cpp	Makes shutdown idempotent and guards beacon callback during shutdown.
src/ros2_medkit_discovery_plugins/ros2_medkit_param_beacon/include/ros2_medkit_param_beacon/param_beacon_plugin.hpp	Adds explicit destructor override.
src/ros2_medkit_discovery_plugins/ros2_medkit_param_beacon/src/param_beacon_plugin.cpp	Makes shutdown safer (thread join + guarded polling) and clears client caches under lock.
src/ros2_medkit_integration_tests/demo_nodes/lidar_sensor.cpp	Fixes initial timer self-cancel race and cancels scan timer before recreating it.
src/ros2_medkit_integration_tests/demo_nodes/engine_temp_sensor.cpp	Cancels publish timer before recreating it after parameter updates.
src/ros2_medkit_integration_tests/demo_nodes/long_calibration_action.cpp	Ensures shutdown preparation runs from destructor as well.
src/ros2_medkit_gateway/test/test_sse_fault_handler.cpp	Cancels executor in TearDown to avoid teardown-time races.
src/ros2_medkit_fault_manager/src/rosbag_capture.cpp	Cancels/resets discovery retry timer during stop() to avoid late callbacks during teardown.

Comments suppressed due to low confidence (1)

src/ros2_medkit_discovery_plugins/ros2_medkit_param_beacon/src/param_beacon_plugin.cpp:147

• shutdown() uses an atomic + mutex, but the initial guard is a plain load(). Using shutdown_requested_.exchange(true) (like the other plugins in this PR) would make the shutdown path strictly single-entry and avoid duplicated notify/join work if shutdown is ever called concurrently/re-entrantly.

void ParameterBeaconPlugin::shutdown() {
  if (shutdown_requested_.load()) {
    return;
  }
  {
    std::lock_guard<std::mutex> lock(shutdown_mutex_);
    shutdown_requested_ = true;
  }

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.