Embedding cancellation execution ownership

Trap: caller timeout or cancellation looks like permission to free a pool slot or retire the worker because the promise has settled. Fix: reject before admission, remove host-queued work so it never reaches inference, but keep executing work charged until completion or confirmed worker exit; caller settlement and execution ownership are separate. Use independent initialization/execution watchdogs, and never let a short request deadline restart a healthy worker or duplicate durable work.