Detach extension catalog I/O from service state

[pcarrier]

Summary

• serialize durable redb catalog work on the blocking pool without holding the global extension state mutex
• stage persistent create, update, control, attempt, terminal, and lazy-argument flows around the catalog lane
• preserve correlated reply ordering and add a stalled-catalog regression proving STATUS and shutdown admission remain live

Validation

• cargo test -p blit-server --all-targets
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test -p blit-remote -p blit-cli -p blit-guest --all-targets
• pnpm --dir js build
• pnpm --dir js test

[indent]

PR Summary

Detaches the extension catalog from the global service-state mutex so durable redb I/O runs on the blocking pool, serialized by a dedicated catalog_io lane, keeping STATUS reads and shutdown admission live while a catalog write is slow or stalled.

• Moves the ExtensionCatalog out of ServiceState.inner into Arc<Mutex<Option<..>>>, accessed through a new catalog_call helper that runs each op via spawn_blocking.
• Splits catalog work into async paths (commit_catalog_create/commit_catalog_update, persist_attempt_counters_catalog, persist_terminal_catalog, async apply_put_result/complete_pending); commit_transient_create now handles transient-only and mutate_lifecycle_locked no longer writes the catalog.
• Routes mutating controls (CANCEL/RESTART/ENABLE/DISABLE/REMOVE) to a new handle_mutating_control that persists to the catalog before mutating in-memory state, while read-only controls stay inline.
• Adds shutting_down guards wherever an async catalog write can complete after shutdown began, and a regression test proving STATUS and begin_shutdown stay admitted while catalog I/O is blocked.

Issues

All clear! No issues remaining. 🎉

1 issue already resolved

• In prepare_attempt the catalog_io lane is acquired unconditionally before loading arguments, so a stalled persistent catalog write can delay startup of unrelated transient extensions (which never touch the catalog); guard it with if snapshot.args.is_none() like the other lane sites. (fixed by commit de1cb16)

CI Checks

All CI checks passed on 8b13e67.

_{View session}

[github-actions]

Coverage

Crate	Lines	Functions	Regions
alacritty-driver	75.7% (934/1234)	78.7% (74/94)	79.0% (1521/1926)
browser	0.0% (0/825)	0.0% (0/69)	0.0% (0/1404)
cli	39.9% (5920/14836)	46.5% (596/1282)	40.8% (9238/22637)
compositor	35.1% (6042/17209)	49.7% (501/1009)	34.9% (8305/23786)
desktop	78.7% (4363/5544)	71.7% (383/534)	75.2% (6032/8020)
fonts	85.3% (756/886)	89.9% (71/79)	86.4% (1485/1719)
fssync	92.3% (5503/5961)	94.4% (501/531)	92.5% (10160/10981)
gateway	34.0% (669/1966)	40.2% (68/169)	31.4% (1029/3279)
git	87.7% (4643/5295)	90.2% (378/419)	87.6% (7410/8463)
guest	82.8% (2286/2760)	80.4% (259/322)	81.5% (3813/4677)
lsp	77.2% (2688/3483)	79.4% (262/330)	74.9% (4210/5619)
proxy	19.2% (172/898)	20.5% (26/127)	21.0% (293/1392)
remote	91.7% (17474/19055)	94.5% (1229/1300)	89.3% (28379/31776)
sd-notify	73.9% (68/92)	100.0% (6/6)	83.2% (109/131)
server	56.5% (32606/57757)	63.7% (2811/4415)	57.8% (49443/85615)
ssh	32.2% (165/512)	48.2% (27/56)	31.4% (261/830)
upsidedown	31.4% (391/1247)	27.8% (55/198)	34.8% (797/2287)
webrtc-forwarder	8.5% (238/2805)	10.7% (22/205)	6.3% (289/4595)
webserver	64.4% (1250/1941)	67.6% (173/256)	66.6% (2099/3151)
Total	59.7% (86168/144306)	65.3% (7442/11401)	60.7% (134873/222288)

[github-actions]

🔗 Preview: https://blit-lwz7ithye-indent.vercel.app