fix(server): held delegated stops no longer starve siblings#33326

A delegated child whose thread is busy can hold Stop's serial descendant walk across the worker's deadline. Every retry reaches that child first, so later siblings remain active while replacement work waits behind cleanup.

Stop sibling branches concurrently inside ThreadManagementService, preserving stable command IDs, reused-child deduplication, remote cancellation, failure collection, and stop-before-recursion ordering. The cleanup effect still waits for every branch; replacement work cannot bypass an unfinished retrying cleanup.

Proof uses the real effect worker and thread lock with TestClock. With the first child's lock held across three real worker deadlines, the upstream service leaves its free sibling starting; this change interrupts the sibling and its grandchild. Replacement execution stays blocked, then observes the held child already interrupted after release and the stop effect succeeds. The fixture's 95 seconds is virtual, not a reproduction of the historical patched-build incident.

Validation: focused thread-stop, remote-delegation, idempotence and partial-failure cases passed; pnpm exec vp run check:changed passed. Local cubic reported no issues (repository context unavailable for GitCafe origin).

Scope: standard change because it changes concurrent cleanup. This fixes sibling starvation. It does not establish what held the historical Pi child's lock, add waiting-state UI, change worker timeout/retry exhaustion policy, or measure resource load for wide trees. Sibling concurrency is unbounded so a fixed pool of blocked children cannot starve the rest. Worker/outbox implementation, rollback, Pi adapter and the excluded usage-limit work are untouched.

Additional service-boundary probes verified provider-native/childless records are ignored, remote interruption versus stop preserves completed results, a rejected remote stop still permits sibling cancellation while failing the walk, and explicit reasons reach local descendants and remote results. Disabling the respective branches failed these probes. Reused-child public cancellation outcomes passed, but the exact once-per-subtree traversal optimization is unproven: receipt replay masks duplicate traversals. The synchronous dedup guard is retained.

Runtime transcript (real worker, virtual clock):

Proof audit round 1 requested additional preserved-branch evidence. Round 2 passed the scoped functional change with the traversal-count and wide-tree-load limits above disclosed.

Remaining issue scope: permanently held child locks, bounded completion under that condition, and visible blocked-on-cleanup status are deferred. #30653 stays open for those requirements.

Council review

Rounds: 1

No blockers or required fixes. Clarified the timing-fixture comment. Kept the held child's non-interrupted pre-release assertion because the contract under test is cancellation and replacement ordering; the post-release assertion requires exact interrupted status. Failure selection may follow completion order; every failure remains logged and the walk still fails.

Created with GPT 6.1 Sol (lead, review, audit), Claude Opus 5.5 (build, trim and review), and Grok 4.7 (review and evidence) in T3 Code through Codex, Claude and Grok harnesses.

Refs #30653