sched: fence scheduled resumes at shutdown so none outlive ownership

docs/deployment_scheduling.md

@@ -96,8 +96,11 @@ retrying it. Corrupt or contradictory records fail closed with
 diagnostics and block the schedule rather than clearing overlap.
 
 On shutdown the server stops admission first and drains active tasks
-within the grace period; anything still running keeps its executing
-mark, and the next startup recovery abandons it truthfully.
+within the grace period; new scheduled resumes are rejected for the
+duration of the drain, and a resume still running past the deadline is
+cancelled and joined before ownership is released, keeping its marks
+for the next startup recovery. Anything else still running keeps its
+executing mark, and the next startup recovery abandons it truthfully.
 
 ## Occurrence inspection
 
@@ -194,8 +197,9 @@ await schedules.update_schedule(
 - Manual runs bypass scheduler capacity by design; capacity governs
   scheduled dispatch plus scheduled resumes. Resuming a scheduled
   interrupted run acquires a server execution slot first (rejected
-  while saturated, without dispatching) and releases it when the
-  resumed result is persisted.
+  while saturated or draining, without dispatching) and releases it when the
+  resumed result is persisted; a drain-cancelled resume keeps its marks
+  for recovery instead.
 - A set `max_steps` budget cannot be cleared back to unset through
   update (recreate the schedule for an unbounded budget).
 - MCP-backed servers reject scheduler enablement for now.