fix: close durable runtime stores after shutdown drains writers

[soyeladice-svg]

What

Closes #676.

Pass the three CLI-owned durable stores explicitly to MCPServer and close them during server shutdown only after MCPProxy has confirmed that all admitted calls have drained. Reuse the existing admission gate and drain logic.

Shutdown is serialized. Every owned store gets an independent close attempt; successful closes are not repeated, failed closes can be retried, and an earlier proxy shutdown error remains the primary error. Kill-switch store close uses its existing lock. Embedded servers retain ownership of stores they have not explicitly transferred.

Why

The production runtime creates persistent audit, kill-switch, and sensitivity stores but did not close their handles in the server lifespan. Closing them before a cancellation-resistant call has drained would instead break its final durable writes.

Security impact

No policy, receipt format, audit-chain, or TEE behavior changes. Durable handles remain open when draining fails, so an admitted tool can still persist its audit outcome and state before a later shutdown retry closes them.

Test plan

• Focused production wiring/lifecycle suite: 11 passed, including five new regression tests using real SQLite stores.
• Unit suite exercised: initial run 2,310 passed, 6 skipped, 9 failed because the environment's SOCKS proxy required the missing optional socksio package. After installing socksio in the test environment, all 9 failed cases passed on rerun.
• Ruff check passed.
• Mypy passed (77 source files).
• Bandit passed with no findings.
• git diff --check passed.

Regression coverage: normal closure; one close failure does not stop other stores and retries only the failed close; original proxy cleanup errors are preserved; incomplete drain permits real durable audit/state writes, rejects new admissions and then closes on retry; borrowed stores are not closed.
No manual deployment test was performed.

AI assistance: prepared and tested with Codex for Burs-IA.

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[imran-siddique]

This meets #676 and the September 24 constraint: the stores close only once shutdown_drained is set, stay open when draining fails so a late call can still write its outcome, and each close is attempted independently with the original shutdown error kept as primary. All 18 checks pass, fuzzing included. Thanks @soyeladice-svg.