Drop teardown-time futures with intercepts disabled

[mystenmark]

What

Two teardown sites drop user futures on the main thread after block_on has returned and the reactor context is gone: the blocking pool's un-run jobs, and runnables parked in Node::paused by pause(). Drain both with syscall intercepts disabled, so resources captured by those futures close through the real libc.

Why

A dropped future runs the Drop impls of everything it holds. Those can make an intercepted syscall — close() on a file or socket routes through plugin::simulator()/plugin::node(), which reach context::current() with no reactor and panic ("there is no reactor running"). The panic is inside an extern "C" fn, so it cannot unwind and aborts the process.

Blocking pool. A job enqueued but never run is dropped when PoolShared is dropped, from Executor::drop. This surfaced as ~38 sui-adapter-transactional-tests aborting with SIGABRT once a sui workspace pinned this repo's blocking-pool revision; the stack was PoolShared drop → un-run job closure → sui IndexStore → Arc<RocksDB> → rocksdb_close → close() → interceptor → panic.

Paused runnables. pause() parks a node's woken runnables in Node::paused. The node map is shared with runtime::Handle, so it outlives the executor and is torn down after the context is gone. Same abort, reached from a different direction. No current sui caller uses pause(), so this one is latent rather than observed — but it is a headache to debug when it does fire, and the fix is the same one line.

The interceptors are left strict otherwise (a scoped disable that restores the prior setting) rather than made globally tolerant of a missing reactor — a context-less intercepted syscall anywhere else is still a real bug worth surfacing.

Test plan

msim/tests/teardown_drop.rs parks a future owning a File at each teardown site and drops the runtime; File::drop calls the intercepted close(). Run under nextest so each test gets its own process — an abort cannot be caught.

• unrun_blocking_job_dropped_at_teardown and paused_runnable_dropped_at_teardown are the regression tests, one per site. Each was verified by reverting its own fix and re-running: both SIGABRT without it, pass with it.
• task_woken_as_main_future_completes and waiter_woken_by_blocking_pool_shutdown pass both before and after. They are guards, not reproductions: the ready queue is not a hazard because the main task runs inside run_all_ready's drain loop, so anything its completion schedules is still run with a context; and a waiter woken by pool shutdown unwinds on the pool thread, which has its own guard.
• Futures parked on the timer wheel are deliberately not covered. They are leaked rather than dropped at teardown (Arc::strong_count is still 2 after drop(rt), with zero Drop calls), so they run no user code and are not a hazard. That leak looks worth a separate look, but it is not this PR.

The file is gated on cfg(msim); cargo test without it builds the std path, where the simulator API does not exist. Full suite: 40/40 pass under --cfg msim, std mode builds clean. Sui cargo simtest --test simtest (sui-benchmark) against this branch: 34/34 pass, and the transactional tests that originally aborted now pass instead of SIGABRT.