Complete supervised recovery and restart shutdown

[cevr]

Protected recovery could stop its own supervisor and wait forever. A failed initial spawn in a restarted generation could also end supervision early, leave retry budget unused, and never complete the actor exit.

Treat the supervisor as a self-stop caller. The shutdown owner waits for its cleanup and reports cleanup defects. After a restarted generation fails during startup, read its recorded exit and apply the existing retry policy.

1. Self-stop and cleanup:

 protected supervisor recovery → actor.stop
-  join shutdown owner → owner waits for supervisor
+  mark supervisor interrupted → finish protected region
+  shutdown owner waits for cleanup → publish terminal result

2. Restart failure:

 supervisor → newRuntime.start
-  startup defect ends supervisor without completing actor
+  read recorded generation exit
+  apply classifier and remaining budget
+  retry or complete actor exit

Full local gate:383 tests847 assertions,types,lint,format,build,and examples. Real actor tests cover protected self-stop, cleanup waiting and defects, retry exhaustion, and successful recovery on the third startup. A patch changeset records both fixes.

Two Counsel rounds are complete. Neither review found a blocker in the final change.