watcher: save state when it stops and wait for that save (closes #114)

The final save at shutdown came from the state's own stop hook, while
the watcher's stop hook only cancelled its run loop, so a check under
way could change state after that save or be cut off at exit. Run now
saves state as it returns, and the watcher's stop hook waits for Run,
bounded by the shutdown deadline. The state's own save stays; Save
holds the state lock for the whole write, so the two cannot overlap.
The start hook derives the watcher's context with WithoutCancel, so
the linter needs no exception. A new test stops a watcher built by New
and reads the change back from the state file, with no DNS.

Model: opus-5-5

README.md

@@ -611,9 +611,10 @@ repository's `Dockerfile` and runs it. The app needs:
      from a previous cycle.
 4. **On change detection**: Send notifications to all configured
    endpoints, update in-memory state, persist to disk.
-5. **Shutdown**: Persist final state to disk, wait for in-flight
-   notification deliveries to complete, stop gracefully. The wait is
-   bounded by the fx shutdown timeout (15s by default): deliveries still
+5. **Shutdown**: The watcher stops checking and saves the final state
+   to disk, and shutdown waits for that save before it goes on. Then it
+   waits for in-flight notification deliveries to complete. Both waits
+   share the fx shutdown timeout (15s by default): deliveries still
    retrying against an unreachable endpoint when that expires are
    abandoned, and the number abandoned is logged at warn level rather
    than dropped silently. Notifications generated after shutdown has