fix(kqueue): stop wakes every runner and drains submitted jobs

[gg582]

Problem

On kqueue, cwist_io_queue_run() was a while (1) around kevent() with no timeout. cwist_io_queue_stop() only called close(kq_fd).

• Hang: BSD kernels need not wake a thread already blocked in kevent() when the descriptor is closed. cwist_scheduler_destroy() could then hang in pthread_join().
• Leak: job wrappers still queued at shutdown were leaked. The Linux io_queue.c drains them.
• Descriptor reuse: the closed fd number could be reused while a runner was still waiting on it.
• No coverage: the macOS CI job never ran the scheduler or queue tests, so none of this was caught.

Fix (src/sys/io/kqueue.c)

The kqueue backend now has the same contract as io_queue.c:

• Stop rules: a running flag and a pending_jobs count. Runners return only once stopped and drained. submit returns false after stop; it counts the job before checking the flag, so no in-flight submit is lost.
• Wake: stop triggers an EVFILT_USER event (ident 0). The event is registered without EV_CLEAR, so it stays active and every runner wakes, not just the first.
  • A runner that wakes while another runner holds the last jobs backs off for 1ms instead of spinning.
• Close: the descriptor is closed only in destroy, after the join. destroy first removes the wake event, then frees any queued jobs that never ran.
• Full GC: runners call cwist_gc_scope_flush() after each job, as io_queue.c does. Without it, test_io_queue_full_gc would fail on macOS.

Tests

• New tests/test_io_queue_stop.c: works on every backend and fails within 5s instead of hanging. It checks three cases:
  1. 4 idle runners wake on stop.
  2. 2000 jobs submitted before stop all run, and submit fails after stop.
  3. Destroying a stopped queue that no runner ever ran frees its jobs.
• macOS kqueue CI job: now also runs test_scheduler, test_gc_job_handoff, test_io_queue_full_gc, test_full_gc_ownership_handoff and test_io_queue_stop.

Fixes the new test found in the other backends

• io_queue.c (Linux), use-after-free: after running a job, the runner cleared func and arg in the popped node. By then that node was the queue's sentinel. Another runner could already have popped past it, retired it and freed it, and the allocator could have reused the memory as a newly submitted job node. Clearing it made that job silently skip. TSan CI caught this as g_ran != JOBS.
  • Fix: pop now copies the callback and argument inside the EBR critical section, and the node is never touched afterwards.
  • Check: with the queue and the test built with TSan and pinned to 2 CPUs, the old code failed 9 of 500 runs and the fix failed 0 of 500.
• io_select.c (portable fallback): it ran the lock-free Michael & Scott queue with no memory reclamation. pop freed the old sentinel right after its CAS, while another consumer or a producer could still be reading it.
  • Fix: switched to the Michael & Scott two-lock queue. Producers link under tail_lock. Consumers pop under head_lock and copy the job out before unlocking. A node is freed only once nothing can reach it.
  • Check: built on Linux against test_io_queue_stop, it passed 300 of 300 plain runs and 200 of 200 TSan runs, with no race reports.
• test_latency_probe: the test now waits for each round to finish before starting the next one, instead of coalescing eventfd writes. Without that, a slow runner hung the test.