fix(agent): retire peer-event listeners before shutdown

[branarakic]

Late libp2p events, startup admission checks and periodic reconciliation can resume after shutdown and mutate a restarted node's sync state. Each start now opens one PeerSyncSession before catalog/bootstrap producers run; stop closes it synchronously before dependency teardown. The session owns its signal, scheduler, peer leases, freshness, progress, enqueue cooldowns and reconciler backoff. Restart creates a fresh session, while disconnect history remains available.

PeerEventLifetime supervises connection continuations and synchronous commits. Admission precedes best-effort enrichment and sender-key draining; catalog announcements and replays retain their subsystem-owned drain. Stale success and failure continuations cannot launch subsequent phases, clear replacement replay fences, report errors or commit accounting.

The published runSyncOnConnect and runSelectedSharedMemoryRetry helpers preserve callers that pass Set and omit signal. A shared boundary adapter retains the caller's original Set for exclusion and release, supplies an invocation lifetime when omitted, and forwards explicit lease owners and signals unchanged. The original context is passed unchanged, preserving prototype methods, inherited getters and callback receivers even on frozen class instances. Normalized lifetime and lease objects are passed separately to the internal workflows, which retain required types and cancellation checkpoints.

Validation: 223 tests across 14 compatibility, connection/event/session lifecycle, retry, scheduler/accounting, RFC-64 lane/recovery and outbox suites pass, including 17 package-subpath consumer cases. Four legacy-consumer runtime cases and the public type checks reproduce the compatibility regression on the preceding head. Four additional class-context cases reproduce prototype-method loss on the preceding head. The runtime package build from empty agent output, registered public declarations/package checks, strict checks for both compatibility fixtures, lint, test inventory and diff checks pass. The consumer fixture constructs a typed current-contract result without importing an orphaned build module from another branch, fixing the failed CI shard and its dependent coverage gate. The private admission-pressure fixture now stubs its synthetic peer's connection I/O, retaining real durable/SWM admission and zero-peer-backoff assertions; its former connection timeout also reproduced before this fix.

Closes #2504.

[branarakic]

Commit d8e2987 covers the three continuation/error lines identified by CI: connection admission cancellation, a peer-update probe rejecting during shutdown, and an unexpected admission failure while running. All 67 sync/retry tests pass. A targeted local coverage report confirms all three reported lines execute; the full merged-package coverage gate is now running again in CI. No coverage thresholds or production behavior were changed.

[branarakic]

The new CI run reaches the existing selected-private restart race: 679 passing tests and one failure in run 34161230815. The empty identity response at 21:00:18 is followed by a 59911 ms unreadable-response backoff. Issue #2507 and green PR #2508 track this root cause. The three prior changed-line coverage gaps execute in the local coverage report; full CI needs to be checked again once #2508 lands.

[branarakic]

Fixed the remaining session-migration CI fixtures: diagnostics now supplies the session-owned freshness/backoff maps; the concurrent-sync assertion reads the session set; the ACK identify fixture explicitly represents an active session. All 71 tests across those three suites pass, together with agent build/type/package checks and lint. The fourth failing shard reproduced the separate empty network identity response → 60-second backoff bug tracked by #2507 and fixed in #2508; that dependency remains open.