#28093 carry of #27257: preserve daemon ownership through teardown

Carries #27257: cmux-next test windows and panels must close after each test, while preserving daemon ownership safely through teardown.

The original PR's latest exact-head review found two P2 teardown hazards in AppTestDaemonOwner:

• a cancelled endpoint caller could remove its still-running ensure task before reap joined it;
• an endpoint whose process identity was not verified could still receive a graceful socket shutdown, potentially stopping a replacement daemon.

This carry keeps admitted ensure tasks until teardown joins them, and only performs graceful shutdown for verified process identities. Unverified endpoints use a bounded exit observation and preserve state when ownership remains ambiguous.

Validation: git diff --check passed. Fleet Swift tests were not run because the broker was temporarily rate limited while this carry was prepared.

Original PR: https://github.com/manaflow-ai/cmux/pull/27257

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Carries #27257: cmux-next tests must close the windows and panels they open after each test, while teardown preserves daemon ownership so a replacement daemon is never accidentally stopped.

An exact-head review of the original found two teardown hazards in AppTestDaemonOwner: a cancelled endpoint caller could drop its still-running ensure task before reap joined it, and an unverified endpoint could receive a graceful socket shutdown that stops a replacement daemon. This carry keeps admitted ensure tasks until teardown joins them, and performs graceful shutdown only for verified process identities. Unverified endpoints get a bounded exit observation and preserve state when ownership is ambiguous.

Behavior changes

• DaemonConnection.closeAndWait() and DaemonService.shutdownConnectionAndWait() join in-flight startup and reconnect attempts before the owner is reaped.
• Page Info certificate, site settings, and site data windows close with the retired page, and a late certificate response can no longer present anything.
• The Mac screen approval prompt closes and drops the last request's panel on settle.

Test harnesses now tear down daemons, windows, palette panels, and cached browser pages even on early failure or cancellation.

Validation: git diff --check passed. Fleet Swift tests were not run because the broker was temporarily rate limited while this carry was prepared.