Make Batch startup and shutdown ownership explicit and bounded

[MasterOfBinary]

Outcome

Make stream Batch startup, source stop, accepted-work treatment, execution cancellation, error delivery and termination separate documented operations. ShitQuant needs safe redeploy/restart boundaries; a canceled context is not a durable drain guarantee.

Scope

• Resolve remaining mutation-after-start panics (WithBufferConfig and analogous pending options) through immutable startup options or explicit error-returning rules. Reject invalid starts before consuming source/single-use state.
• Reconcile open PRs fix(batch): panic recovery, deadlock-safe error sends, bounded prealloc, Done() race #65/feat(batch): configurable context-cancellation mode (WithCancelMode) #76 on current master. Review their useful fixes; mergeability is not approval and a source CancelMode is not the complete lifecycle.
• State source-dequeue versus engine-acceptance ownership, drain versus abort behavior, and how Define source ownership and cancellation without silent in-flight loss or blocked sends #83 handles the in-flight gap.
• Define a bounded graceful budget with separate intake/execution contexts where required. On expiry request cancellation; report incomplete shutdown while noncooperative work remains, retain capacity accounting, and expose eventual termination.
• Define error/output consumer obligations and saturation behavior. No goroutine may hang forever on an internal send under the documented cooperative shutdown contract. If diagnostics are dropped on abort, expose and document that limitation instead of promising a lossless ledger.
• Make cancellation/EOF/Done/error-channel order, repeat shutdown and start/mutation races explicit.
• Explain that user functions must cooperate with cancellation. In-memory Batch is neither durable work nor exactly-once external execution.

Verification

Synchronized tests for cancel during source forwarding, batch formation, admission saturation and handler execution; stopped/slow error consumers; repeated shutdown and startup mutation; EOF remainder; handlers that delay cancellation. Check error-channel/Done ordering and no false success while work remains. Run normal repository race/vet/lint/documentation gates.

Relationships

Coordinates with #73 admission, #77 startup validation, #83 source forwarding and #89/#92 cancellation outcomes. Those focused issues own their detailed changes; this issue owns the lifecycle contract and core mechanics. Do not create mutual native blockers. It does not make independent request/flow runtimes depend on stream implementation; they must implement equivalent ownership guarantees suitable to their own APIs.