fix(pm2): add generation-safe fleet shutdown protocol

[xiaoxueSunn]

Summary

Extract the PM2 fleet stop/start work from the original mixed PR into a dedicated stacked PR.

This PR:

• adds generation-safe PM2 fleet shutdown and restart intent tracking
• introduces supervisor prepare/commit/abort handshakes and loopback IPC
• verifies exact PM2 descriptors before acting on a process
• adds startup budgeting and first-upgrade compatibility fences
• reports per-instance shutdown/restart outcomes without conflating stale generations

Stack

#596 has merged. This PR still depends on #598 and remains Draft until #598 merges.

Validation

Latest master merge-state validation:

• mutation gate + RIFF focused regression: 7 files, 125 tests passed
• PM2 fleet / descriptor / exact-start / preflight / capability / start-transaction / supervisor IPC / cleanup: 16 files, 218 tests passed
• combined focused result: 343 tests passed
• concurrency stress on gate + RIFF shutdown + fleet shutdown + PM2 start transaction + worker retirement: 125 tests × 10 rounds = 1,250 passed
• TypeScript typecheck (tsc --noEmit)
• git diff --check

Earlier complete stacked unit suite:

• 699 files, 10,757 passed, 34 skipped
• production build passed

Validation did not restart daemon, PM2, or RIFF runtime processes.