fix(api): bound Fiber probes and synchronize shutdown

[ryan-wong-coder]

Linked Issue

Fixes #9

Summary

• make the Fiber health adapter GET-only and reject every probe body
• enforce a 64 MiB aggregate read-buffer budget across configured connections
• replace synchronous readiness callbacks with an allocation-free atomic tracker
• synchronize single-serve startup, draining, repeated shutdown, and concurrent shutdown completion
• document the implemented resource and lifecycle boundaries

Required Format

• Branch name uses an approved prefix: fix/.
• PR title and the single commit use Conventional Commits.

Scope And Project Status

• This PR solves one issue or one clearly scoped maintenance task.
• This PR excludes unrelated formatting, experiments, generated files, local data, credentials, logs, captures, and build artifacts.
• User-facing material distinguishes implemented behavior, target design, and roadmap work.
• No performance benchmark claim is introduced; the O(1), allocation-free tracker property follows directly from one atomic load.

Protocol, Safety, And Compatibility

• This PR does not change quorum, Byzantine fault, proposer-slot, stable-prefix, or epoch-transition rules.
• BatchAC semantics are unchanged.
• Canonical ordering and execution semantics are unchanged.
• External finality and proof semantics are unchanged.
• Canonical encoding, domain separation, signatures, IDs, state commitments, and wire schemas are unchanged.
• WAL, atomic publication, snapshots, pruning, synchronization, replay, and recovery are unchanged.
• Business networking, admission, cross-ledger validation, and protocol resource accounting are unchanged.
• The operational HTTP path is more tightly bounded and introduces no unbounded work.

This intentionally removes the unreleased callback-based readiness API and the probe body-size setting. The repository has no released runtime or users, so no compatibility shim or migration path is retained. Rollback is the single commit if the adapter must be restored before node composition exists.

Validation

• git diff --check
• python3 scripts/check_docs.py
• go mod verify and go mod tidy -diff
• go vet ./...
• go test -count=1 -mod=readonly ./...
• go test -race -count=1 -mod=readonly ./...
• python3 scripts/check_go_architecture.py
• Linux amd64 and arm64 builds with -trimpath
• go test -race -run 'TestShutdownDuringStartupPreventsServing|TestConcurrentShutdownWaitsForOneServeExit' -count=100 ./pkg/api/httpserver
• Real-listener negative tests cover non-GET methods, one-byte and oversized bodies, oversized headers, startup races, duplicate Serve, concurrent shutdown, and secret disclosure.

Protocol vectors, Byzantine models, storage recovery, snapshots, chaos, and performance benchmarks are not applicable because this PR changes only the unreleased operational health adapter and adds no protocol, storage, consensus, or business request path.

Risk And Rollback

The lifecycle state machine and shared shutdown completion are the main implementation risk. Deterministic gated-listener tests, active-request drain tests, repeated stress under the race detector, and real loopback tests cover the relevant interleavings. Revert commit b1c344f to restore the previous bootstrap adapter; no persisted data, wire schema, or migration is involved.