host: add supervisor-gated clean core.restart RPC

Return success before scheduling the existing shutdown path, coalesce pending
requests, and mark #loop invocations with SAUSAGE_LOOP=1. Keep core.exit
compatibility and document explicit per-call approval for all agents.

Card: SAU-134

cli/src/host.rs

@@ -26,6 +26,8 @@ pub(crate) struct Inner {
     pub(crate) journal: Arc<journal::Journal>,
     pub(crate) notifications: tokio::sync::broadcast::Sender<Value>,
     pub(crate) exit: watch::Sender<bool>,
+    pub(crate) loop_supervised: bool,
+    pub(crate) restart_pending: std::sync::atomic::AtomicBool,
     pub(crate) components: components::Components,
     /// Calls hold it for reading from the choice of a version until their
     /// process is in the table. Activation holds it for writing while it
@@ -98,6 +100,8 @@ impl Host {
             }),
             notifications: tokio::sync::broadcast::channel(1024).0,
             exit: watch::channel(false).0,
+            loop_supervised: crate::restart::enabled(std::env::var_os("SAUSAGE_LOOP").as_deref()),
+            restart_pending: std::sync::atomic::AtomicBool::new(false),
             components: components::Components::default(),
             admission: tokio::sync::RwLock::new(()),
             shutdown: std::sync::atomic::AtomicBool::new(false),
@@ -143,12 +147,12 @@ impl Host {
         )
         .await
     }
-    /// Wait until a core.exit handler requests a restart.
+    /// Wait until core.restart (after its response grace) or core.exit requests shutdown.
     pub async fn exit_requested(&self) {
         let mut exit = self.0.exit.subscribe();
         let _ = exit.wait_for(|requested| *requested).await;
     }
-    /// Return whether a core.exit handler requested a restart.
+    /// Return whether a restart has reached the normal shutdown path.
     pub fn restart_requested(&self) -> bool {
         *self.0.exit.borrow()
     }