Embedding runtime safety, validation, compatibility, and backfill

Before replacing any embedding worker, keep retirement owned and count active plus retiring workers against capacity. Starting replacements immediately looks responsive but can overlap model sessions and multiply memory; wait for confirmed exit, except native→WASM fallback may briefly overlap while its superseded worker remains tracked. Cooperative shutdown escalates to terminate() after 1.5 seconds and must confirm termination; otherwise latch unavailable. Validate each embed result as one finite configured-width Float32Array per input, then L2-normalize. Never purge vendored models; purge only proven-corrupt external downloads.