feat(daemon): deliver stop reliably and never kill the node unasked

Closing the wallet sent "stop" at most twice, gated on a getinfo probe
that needs the daemon's cs_main, then killed the node after 20 s (Windows)
or 30 s (POSIX) whether or not stop had arrived. A node busy with an
hour-long witness rebuild therefore never got stop, was killed mid-
rebuild, and replayed everything since its last flush on every start.

Delivery (src/daemon/stop_delivery.h, RPCClient::open/trySendStop):
- stop goes over a dedicated client with no probe, so it never waits on
  rpc_'s lock or a cs_main-bound getinfo
- every attempt is classified, and StopDeliveryPolicy decides the next:
  Accepted / 503 = delivered; Queued (reply timeout) is resent at most
  every 30 s; QueueFull / not listening are retried every 1.5 s; a
  refusal after we were heard means the node is shutting down; a 401 on
  our own node tries the next credential source
- POSIX: a group SIGTERM goes out as soon as an attempt fails, which
  bypasses the HTTP queue entirely

Waiting (DaemonController::executeDaemonStop, pure, virtual-clock
tested):
- never kills on its own. Quitting waits as long as the node needs; the
  shutdown screen offers "Close wallet — leave node running" after 3 s,
  and "Kill node (unsafe)" (confirmed) only once stop was delivered and
  the node showed no CPU/I-O progress for ~10 min outside a rebuild
- other callers (restart, rescan, reinstall, switch, ...) wait up to
  120 s, let go once the app starts quitting, and keep watching a node
  that is still running; wallet switch refuses to go ahead then
- EmbeddedDaemon gains stop-session primitives (beginStop,
  pollOwnedProcess, signalGracefulStop, forceKillOwnedProcess,
  ownedResourceUsage over the Linux process group / Windows handle,
  endStop) and only one stop session runs at a time
- the Force Quit button and its stall heuristic are gone; "Leave
  running" aborts a pending stop attempt and closes at once

Verified against the fake daemon with the real GUI: closing mid-rebuild
now delivers stop (or SIGTERM 2 ms after a queue-full refusal) and the
node exits cleanly after its rebuild, where it was SIGKILLed before. The
shutdown screen, its "Leave running" button and the idle Kill offer
(after ~11 min) were checked by screenshot. New strings are English-
only for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/daemon/embedded_daemon.h

@@ -4,6 +4,7 @@
 
 #pragma once
 
+#include <cstdio>
 #include <string>
 #include <functional>
 #include <memory>
@@ -71,6 +72,47 @@ public:
      */
     void markStopRequested() { stop_requested_ = true; }
 
+    // --- A stop session, driven by DaemonController::executeDaemonStop through the app's StopRuntime ---
+
+    /** Marks the stop as requested and stops the monitor, so the session is the only reaper.
+     *  @return true if a process this object launched is still alive; then finish with endStop(). */
+    bool beginStop();
+    /** Polls our own process (reaping it on POSIX) and drains its output; false once it has exited. */
+    bool pollOwnedProcess();
+    /** POSIX: SIGTERM our process group (dragonxd treats it like RPC stop). Windows has no such channel. */
+    bool signalGracefulStop();
+    /** Ends our own process by force (SIGKILL / TerminateProcess) and reaps it. Explicit user choice only. */
+    void forceKillOwnedProcess();
+    struct ResourceUsage {
+        double cpuSeconds = -1.0;  // cumulative; < 0 if unknown
+        double ioBytes = -1.0;     // cumulative storage I/O; < 0 if unknown
+    };
+    /** CPU and I/O used so far by our process (its whole process group on Linux). */
+    ResourceUsage ownedResourceUsage() const;
+    /** Finishes a stop session. The process is gone: release everything. Still running: keepWatching
+     *  resumes the monitor (its exit is still seen, and booked as a clean stop); otherwise let it go —
+     *  the user chose to leave it running. */
+    void endStop(bool keepWatching);
+
+    /**
+     * @brief Parse a /proc/<pid>/stat line: process group (field 5) and utime+stime ticks (fields 14+15)
+     *
+     * comm (field 2) is parenthesised and may itself contain spaces and ')', so fields are read from
+     * after the LAST ')'.
+     */
+    static bool parseProcStatLine(const std::string& line, long& pgrp, unsigned long long& cpuTicks)
+    {
+        const size_t close = line.rfind(')');
+        if (close == std::string::npos) return false;
+        unsigned long long utime = 0, stime = 0;
+        // state ppid pgrp session tty_nr tpgid flags minflt cminflt majflt cmajflt utime stime
+        if (std::sscanf(line.c_str() + close + 1, " %*c %*d %ld %*d %*d %*d %*u %*u %*u %*u %*u %llu %llu",
+                        &pgrp, &utime, &stime) != 3)
+            return false;
+        cpuTicks = utime + stime;
+        return true;
+    }
+
     /**
      * @brief Check if daemon process is running
      */