refactor(orchestrator): make stack detachment explicit

[LukeMathWalker]

Why

Dropping RunningStack implicitly left processes running, but collector startup failure could instead terminate them. That made destructor behavior depend on an incidental thread-creation result and allowed accidental owner loss to leave an unsupervised stack.

What Changed

• add an explicit RunningStack::detach ownership transfer
• restore stack ownership if collector creation rejects the transfer
• make dropping an owned stack fail closed with hard termination
• retain runtime state after destructor termination for explicit cleanup
• update external-stop tests to detach deliberately

Risks / Notes

This intentionally changes internal lifecycle behavior: callers that want processes to outlive RunningStack must call detach. Graceful teardown remains available through shutdown. This is the sixth PR in the lifecycle-ownership stack and targets #487.

AI Assistance

Implementation assisted by OpenAI GPT-5.4.