StartTransientUnit ambiguous completion

Trap: treating a cancelled or non-done StartTransientUnit result as a failed start looks safe, but systemd may already have accepted and launched the unit. Fix: every attempted start owns the generated unit name and enters bounded StopAndWait cleanup; if cleanup cannot confirm removal, terminate the supervisor rather than continue while a possibly active unit is unowned.