fix(telemetry): do not cancel the finalize that reports an interrupted transfer

[sirahd]

The bug

A download interrupted with Ctrl-C reported no telemetry at all. Verified against production: hf download interrupted mid-transfer produced zero documents; it now reports outcome=cancelled.

The terminal report is produced at the tail of the future handed to a _finalizing bridge, after the cancelled work returns:

let result = inner.handle_finish().await;
finalize_download_session(&ds, &result).await;   // <- the report

Both bridges wrapped that whole future in a select! against the cancellation token, so a cancel dropped the future and took the report with it. perform_sigint_shutdown then destroyed the runtime without running the pre-shutdown drain, so anything already in flight was cancelled rather than delivered.

The fix

• Non-racing finalizing bridges. bridge_sync_finalizing / bridge_async_finalizing run their future to completion. The inner work still returns promptly on cancel — it observes the token through the per-task mapped handles. upload_stream_handle is the one caller whose inner future watches no token, so it keeps the old behaviour via explicit _cancellable variants.
• perform_sigint_shutdown runs the pre-shutdown drain before dropping the runtime, as Drop for XetRuntime already did.
• sigint_abort cancels first and tears the runtime down last, waiting in between for finalizing work to finish. XetRuntime counts that work (enter_finalizing / finalizing_in_flight) so the wait ends as soon as it is done.
• final_flush_timeout 2s → 500ms, now both the drain budget and the sigint_abort ceiling.

---

Note

Medium Risk
Touches SIGINT shutdown, task-runtime cancellation semantics, and telemetry flush timing; behavior change is intentional but affects all interrupt and finalize paths on native targets.

Overview
Ctrl-C and abort paths no longer drop download telemetry. Interrupted transfers (e.g. hf download) used to emit no terminal document because finalizing bridges raced their futures against the cancellation token and dropped the tail that calls finalize_download_session, and perform_sigint_shutdown tore down the runtime before draining in-flight telemetry.

Finalizing bridges now run to completion by default (run_inner_async_to_completion / non-racing sync path) so cooperative cancel still returns quickly but the terminal report always runs. Upload stream finish keeps the old cancel race via explicit _cancellable variants because inner work does not watch the token. XetRuntime adds enter_finalizing / finalizing_in_flight so shutdown can wait for that work; sigint_abort cancels first, polls until finalizing work finishes (bounded by final_flush_timeout), then runs the pre-shutdown drain and drops the runtime. FileDownloadSession::finalize_abandoned is idempotent and called from Drop and from download group abort() before runtime destruction. Download finish moves session finalization inside the bridged future. Default final_flush_timeout is 500ms (was 2s). Integration tests cover abort + sigint_abort and interrupt mid-finish_blocking.

^{Reviewed by Cursor Bugbot for commit f620608. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c87c52d. Configure here.}