P0: make ARStack Studio shutdown deterministic on Windows - #99

Critical defect

Closing the Studio window can leave ARStackStudio.exe resident on Windows. The stale process retains single-instance/session ownership so the next launch appears to do nothing.

This violates the repository lifecycle contract in AGENTS.md: stop new work, cancel/retire timers and callbacks, join workers, release handles, and never leave teardown unbounded.

Root cause

Shutdown authority was fragmented:

• QML close only requested SMV STOP;
• StudioDeviceController owned a separate aboutToQuit hook;
• FirmwareManager owned another quit hook;
• SmartSessionController had no explicit teardown boundary;
• DeviceController and FirmwareManager used Qt::BlockingQueuedConnection plus unbounded QThread::wait() during destruction.

That makes Windows process exit depend on QObject/QML destruction order after the GUI event loop is already ending.

Fix

• Add explicit idempotent SmartSessionController::shutdown() to stop discovery/reconnect/profile-sync/handoff/recovery callback owners first.
• Add explicit bounded DeviceController::shutdown() that requests worker-side STOP/serial close, waits for acknowledgement with a deadline, then performs bounded QThread retirement.
• Apply the same bounded retirement contract to FirmwareManager / FirmwareWorker.
• Remove the competing StudioDeviceController app-quit hook.
• Make main.cpp the single shutdown coordinator while worker event loops are still alive: supervisor -> serial worker -> firmware worker.
• Treat emergency thread termination only as last-resort process-exit containment; reaching it reports lifecycle failure and must fail CI.

Permanent regression gate

Adds ARStack Studio Windows Lifecycle CI. It builds the actual Studio GUI executable on Windows and performs two consecutive cycles:

1. launch with --check-app-lifecycle;
2. close primary window;
3. require clean worker-retirement PASS and actual PID exit within 12 s;
4. immediately reopen the application;
5. require a second clean exit.

This directly proves the reported failure mode: close -> process exit -> lock release -> immediate reopen.

Isolation

No embedded firmware, PTP engine, or apps/ied_simulator/** source is changed.

Merge gate

Keep draft until exact-head Windows lifecycle, existing Studio Qt, S8A/S8B ownership, and repository CI are green. Then validate one packaged Windows build manually against Task Manager before merge/release.