fix: harden cancellation binding lifecycle

[miinhho]

Summary

• avoid installing external cancellation listeners or deadline timers after a Job has already committed to cancellation
• stop admitting later cancellation sources when an earlier source aborts reentrantly during registration
• replace recursive descendant cancellation with an iterative traversal so deep ownership chains cannot exhaust the JavaScript call stack
• cover cold cancellation, shared-source deduplication, losing-source cleanup, cancellation while draining children, and an 8,000-level ownership chain

Follow-up hardening from the cancellation lifecycle audit after #18.

Verification

• pre-fix deep-chain reproduction: RangeError: Maximum call stack size exceeded
• pnpm exec vitest run tests/job-cancellation.test.ts — 16 tests
• pnpm format
• pnpm check
• pnpm build
• pnpm test — 10 files, 118 tests
• pnpm pack