fix: close detached broker and worker lifecycles

[Cob-AI]

Summary

• authenticate broker shutdown before process exit and preserve mismatched live endpoints
• verify broker and worker process ownership with per-launch tokens before signalling
• serialize state updates, commit session cleanup against fresh state, and fail closed on stale locks
• close detached workers and brokers from tests and session cleanup without deleting diagnostic state on failure

Verification

• npm test (109 passed)
• npm run build
• npm run check-version
• git diff --check
• focused lifecycle, state, and process tests (23 passed)
• focused broker and worker runtime tests (10 passed)
• independent GPT-5.5 review: PASS, zero medium/high findings

Operational Notes

• legacy broker state without an instance token now fails closed and may require manual cleanup
• Windows process handling is covered by mocked command tests; native Windows lifecycle integration was not run