docs(plan): fence the background shells before shutdown ever snapshots them

The freshness audit rebuilt the shell-lifecycle plan on what the tree now
provides: admission comes from the shared 035 gate with its lease held in
the registry entry, rejection speaks the protobuf spawn-error schema the
wire already uses, and ownership survives a failed kill instead of
vanishing with it. The decisive correction is at shutdown — draining
turns cannot prevent a late spawn because queued Cursor frames and fresh
WebSocket leases outlive the abort, so a synchronous spawn fence now
precedes the global drain snapshot by construction. Three audit rounds
locked the amendments.

Author: lidge-jun