fix(coding/acp): deliver the controller cancel before a cancelled turn ends

[rsbin1178]

A turn arms its controller cancellation with context.AfterFunc and disarms it in
finish, and AfterFunc delivers on its own goroutine: when the prompt returns on its
own cancellation before that goroutine is scheduled, the disarm prevents the
delivery and the controller is never cancelled. The session test then waited its
full thirty seconds for a cancelCount that could never move, which is what main hit.

deliverCancelOnDone now owns that pairing and guarantees the delivery: the disarm
waits for a callback that has already started, and delivers itself when the callback
was prevented and the context is done anyway. The session test asserts the count
directly instead of waiting, and a unit test of the helper pins all three orderings
— cancelled before the disarm, disarmed before the cancel, and an open context —
because nothing here may depend on which goroutine the scheduler runs first.

Measured: the strengthened guard fails against the previous implementation within
two hundred runs (0.8s) and passes two hundred runs with this change, both under
-race.

Evidence

The strengthened session guard fails against the previous implementation within two hundred -race runs (0.8s) and passes two hundred runs with this change. The new helper test pins the three orderings deterministically: cancelled before the disarm delivers exactly once, a disarm before the cancel delivers nothing (a turn that ends on its own must not cancel the controller), and an open context delivers nothing.

TERM=xterm-256color go test ./... (89 packages), go test -race ./internal/coding/acp/ and golangci-lint run --new-from-rev=HEAD~ ./... (0 issues) are clean.