fix(mpc): cancel superseded replans

[frahlg]

What changed

• cancel the active Core replan when a newer generation starts or MPC stops
• keep caller cancellation distinct from service cancellation, so existing Go-DP fallback behavior remains for caller timeouts
• stop superseded work before fallback, shadow publication, plan publication, and diagnostic persistence
• wait for every accepted replan before closing the optimizer, including concurrent Stop calls
• keep the generation check as the final stale-publication guard

Why

#889 prevents an older solve from publishing over a newer request. It did not stop Core from waiting on that solve or from doing fallback and shadow work after the result became stale. This change gives each accepted generation a service cancel path and closes the Stop/Optimize lifecycle race.

Scope boundary

This cancels Core's request and follow-on work. An active native solve in the Unix optimizer sidecar can still run until its existing solver deadline because the Python worker holds SOLVE_LOCK while solving. Worker-side active-solve supersession remains follow-up work under #885.

Verification

• five controlled concurrency tests with go test -race -count=20
• full go test -race ./internal/mpc
• go test -race ./internal/api ./cmd/ftw
• make verify-all: 117 Python tests, all Go tests, Core to Optimizer contract tests, compose migration, end-to-end tests, vet, builds, and Linux arm64/amd64 plus Windows amd64 cross-builds
• three independent read-only reviews found no P0-P3 issues in the final diff

Refs #885