Design: owned backend shutdown, restart and child lifetime outcomes #196

User scenario and problem

Restarting or quitting the desktop must settle the lifetime of its owned backend and children. Extension files must not be reclaimed while code may still run. This is also a normal desktop path and warrants review separately from the extension feature.

Proposed behavior

• Attempt authenticated graceful shutdown first; only escalate against the backend owned by this Electron instance.
• On Windows, terminate the owned process tree when graceful shutdown fails. A failed/uncertain termination must not be treated as permission to delete code or start a competing backend.
• Distinguish process exit from confirmation of child-tree lifetime. Handle races where the backend exits during force-stop, and preserve a retryable state when termination remains uncertain.
• Quit cleanup must report failures and still settle the quit promise; it must not emit an unhandled rejection. Restart reports failure rather than silently starting another instance.
• Non-Windows force-stop does not claim descendant cleanup that was not established.

Acceptance and review

A standalone main-based PR should test graceful exit, forced success, helper failure, process-exit races, timeout, retry, and quit rejection handling. The extension PR only consumes the resulting lifetime outcome to decide safe cleanup.

This Issue records proposed lifecycle policy for maintainer/Claude review, not approval. No global process killing, ACL repair, unrelated application shutdown or merge is authorized.

Implementation for separate review: #198 (Draft, based on main). Exit-race outcomes distinguish a stopped root from unconfirmed descendants; extension resources are retained for the latter.