fix(v2): exit the validator when a service fails in threaded mode

[Rhovian]

Problem

After the first service fails, main returns from Children.wait, dumps diagnostics, and falls off the end — the other service threads keep running. With -Denable-tracy (the #1722 setup), libc exit() then blocks in tracy's shutdown, draining an event queue those threads keep refilling: the error trace prints, then the validator hangs.

Solution

• Children.wait now returns an ExitStatus; failure includes a sandboxed child exiting outside the service protocol (code ≠ 255, previously classified clean).
• New Children.shutdown(code): cancel all services, brief grace period, then raw exit_group — bypassing libc/tracy teardown (std.posix.exit won't: it routes through libc exit() when libc is linked).
• abort() is mode-aware: thread-only exit in threaded mode, exit_group in sandboxed mode so waitpid fires when a multi-threaded service panics.

Deliberately out of scope: #1661 (services allowed to exit without stopping the validator — the shutdown decision is kept in one place in main so it can grow an allowlist) and -Denable-tracy CI coverage of the new test.

Verification

• Hang reproduced on unmodified main at this branch's merge-base (330cc62), ReleaseSafe, -Denable-tracy, threaded, active tracy capture client: wedged >60s after the error trace. Same scenario on this branch exits nonzero in ~1s.
• New threaded-mode black-box test, zig build bb-test-threaded-exit: failing service + tracy-emitting long-runner, asserts prompt exit 1; passes with and without -Denable-tracy.
• Full zig build test green on Linux.

cc @dnut

Closes #1721