[Kilerd]

Scheduled tasks previously started during registration and discarded their handles. Stopping the server could leave both scheduling loops and their separately spawned executions running. Applications now retain a task owner, start work only after all registrations succeed, and stop scheduled work through the same shutdown signal as HTTP serving.

• Make TaskScheduler a registration-only API. cron and interval take &mut self; standalone callers use start() and retain RunningTasks. Application hooks already receive a mutable scheduler.
• Own scheduling loops in a JoinSet and execute each invocation inside its loop. Catch and log both callback-construction and future-polling panics without detaching an execution or adding a Sync bound to callbacks.
• Add shutdown_signal to both APIs, defaulting to Ctrl-C / Unix SIGTERM. Stop new executions immediately, let current ones finish, then abort and join remaining tasks after task_shutdown_timeout (30 seconds by default). The deadline runs concurrently with HTTP draining.
• Discard registrations on startup failure or cancellation. Dropping a running owner or cancelling the serving/shutdown future aborts its scheduled work. Normal shutdown waits for cleanup before returning.

README and MIGRATION document the registration change, standalone ownership, custom signals, and timeout configuration. Cancellation requires tasks to yield; application-created detached tasks and blocking work are outside this ownership. HTTP drain deadlines, public preparation, and application cleanup hooks remain follow-up work in #82.

Validation passed:

• cargo check --workspace --all-features
• cargo test -p gotcha
• cargo test -p gotcha --all-features
• cargo clippy --all-features --workspace -- -D warnings
• Formatting and diff checks

Tests cover inert registration, graceful completion, timeout/drop/cancel cleanup for cron and interval jobs, and panic isolation with a Send-only callback. Public-API tests exercise both application APIs with real HTTP requests, including task timeout while HTTP is still draining, serving cancellation, and registration error/panic/cancellation. Subprocess tests verify clean exits on real SIGINT and SIGTERM without signalling the test runner.

All 11 GitHub CI checks passed for a9f40a3a12bf04a03cb445e71bfa0cb6743f068e.

Closes #93
Related to #82